Maintaining GDPR Compliance

Though the much anticipated General Data Protection Regulation implementation date has come and gone, compliance efforts undertaken by security and compliance groups within many global organisations are far from achieved.

In fact, in many cases, the work is just beginning. As a risk-based regulation, the GDPR requires organisations to determine and implement data security best practices. These best practices apply differently depending on the circumstances of specific organisations.

As most organisations have learned by now, the GDPR applies to any organisation that processes the personal data of European Union citizens and residents or provides services to EU residents.

Organisations in any industry or sector, including profit and nonprofit, operating in the EU or selling goods and services to EU residents are in scope for this regulation.

One of the main goals of the GDPR is to address the lack of accountability seen under previous data protection regulations such as the EU Data Protection Directive.

To increase data-related protections given to data subjects requires organisations to define what best practices should be implemented and, perhaps more importantly, to create a plan to continually monitor and adjust these best practices as technologies used by organisations and cyber-criminals evolve.

GDPR and Data Security

With organisations relying more heavily on big data and the resulting business intelligence derived from such information, personal and corporate data is now more valuable than ever. At the same time, this business intelligence is more at risk.

Given that accountability and enforcement are two of the key aspects of GDPR, organisations must look closely at operational behaviors and evaluate how those behaviors tie into their current and future approaches to information security.

Furthermore, because Article 30 of GDPR requires records of processing, it is imperative for organisations to know how and why data is being collected, stored and processed.

Specifically, organisations need to establish information security best practices to ensure that data is:

  • Collected for specific purposes.
  • Processed securely, limiting risk of compromise.
  • Stored for a defined amount of time.
  • Wiped to remove personally identifiable data when necessary.

In addition to the records criteria touched upon in Article 30, GDPR also requires full disclosure of processing activities through privacy notices (Article 13) and identification of legal basis for data processing (Article 6), and it also lays out conditions for obtaining data subject consent (Article 7).

All these requirements mandate that organisations establish ongoing, risk-based due diligence internally, and for any third party that might access or process their data.

While data controllers and processors have different roles under the GDPR, the potential of large fines and associated reputational damage for noncompliance means that all involved parties must take exceptional care with information security practices.

Establish Best Practices

As organisations continue honing their approaches to information security to address GDPR-related requirements, they will need to fill the historic gaps typically found with out-of-date and often antiquated practices.

Organisations can begin to shift focus from detection and remediation efforts to more proactive measures by embracing current security-related best practices including:

  • Establishment of more robust data protection policies for current and forward-looking privacy principles.
  • Creation and enforcement of appropriate mobile device management policies and standards, including operating system policies, passwords, encryption, remote wipe, bring-your-own device criteria, lost or stolen device policies, and apps policies and management.
  • Development and effective maintenance of up-to-date encryption standards for servers, systems, laptops and mobile devices.
  • Establishment of a formal, physical, and logical security training program for all personnel and a well-planned and rehearsed approach to incident response.

Security-related best practices can address critical components of GDPR compliance. However, by establishing such robust practices, organisations can also begin to realise a significant return on investment.

Consumers want to know their information is safe, properly secured, and handled appropriately, which is increasingly reflected in their spending habits.
 
Employees also want to trust employers’ handling of their personal data, so organisations interested in securing the best talent should take GDPR compliance seriously.

Organisations that understand the importance of GDPR compliance can better attract and serve consumers and engage talented employees.

Get Proactive

Data is the most valuable asset for organisations today. The related information security practices put in place to secure that data are not only critical for compliance and governance issues, but for aspects of operational, reputational, and fiscal concerns as well.

As organisations move deeper into 21st-century technology and data requirements, they can use increasingly stricter regulatory requirements to help propel business forward.

Though it might seem an onerous task, the GDPR and efforts to maintain compliance could bring improved efficiencies, savings, and cost benefits to organisations that embrace it.

Even more, consumers and employees might be more likely to gravitate toward companies that prioritise maintaining privacy rights and strong information security.

Information- Management
 
You Might Also Read: 

Get Ready For ePrivacy Regulation:

Playing Catch-Up With GDPR:

 

« Help The Aged: Indian Cops Give Cybersecurity Tips
What is Digital Twin Technology? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Global Knowledge Training

Global Knowledge Training

Global Knowledge is a worldwide leader in IT and business training, featuring Cisco, Microsoft, VMware, IBM, security, cloud computing, and project management.

Foundation for Strategic Research (FRS)

Foundation for Strategic Research (FRS)

The Foundation for Strategic Research is France's main independent think tank on strategic, defense and security issues. Cyber security is covered as part of the study areas.

Panda Security

Panda Security

Panda Security specializes in the development of endpoint security products and is part of the WatchGuard portfolio of IT security solutions.

Asavie

Asavie

Asavie provide solutions for Enterprise Mobility Management and secure IoT Connectivity.

Softtek

Softtek

Softtek provides comprehensive software Quality Assurance and Testing that identifies the correctness, completeness, and quality level of software products.

Cofense

Cofense

Cofense (formerly PhishMe) is a leading provider of human-driven phishing defense solutions.

Recorded Future

Recorded Future

Recorded Future arms security teams with threat intelligence powered by patented machine learning to lower risk.

Computing Technology Industry Association (CompTIA)

Computing Technology Industry Association (CompTIA)

CompTIA is dedicated to advancing industry growth through its educational programs, market research, networking events, professional certifications, and public policy advocacy.

Cybersecurity Tech Accord

Cybersecurity Tech Accord

The Cybersecurity Tech Accord promotes a safer online world by fostering collaboration among global technology companies.

Adzuna

Adzuna

Adzuna is a search engine for job ads used by over 10 million visitors per month that aims to list every job everywhere, including thousands of vacancies in Cybersecurity.

Revere Technologies

Revere Technologies

Revere Technologies is a pure-play cyber security solutions and services provider in Sub-Saharan Africa.

ScorpionShield

ScorpionShield

ScorpionShield CyberSecurity is an EC-Council Accredited Training Center, and an On-Demand Service for Cybersecurity professionals.

Nexon Asia Pacific

Nexon Asia Pacific

Nexon solutions include cloud infrastructure and services, unified communications, managed security services, business continuity, secured high-performance network and business applications.

Ballistic Ventures

Ballistic Ventures

Ballistic Ventures is a new kind of venture capital firm, built by and for cybersecurity entrepreneurs and investors.

Cyber1

Cyber1

CYBER1 is a leader in cyber security advisory and solutions. We are uniquely placed to help customers achieve cyber resilience and thus, safeguard reputation and value.

Entech

Entech

Entech is a managed IT service provider. We work behind the scenes on your network to ensure data security and integrity.

Protecto

Protecto

Make privacy and governance effortless. Brakes allow you to drive faster. Stronger data privacy and security enable companies to unlock the full potential of the data.