The last two weeks have been met with varying degrees of panic by companies big and small trying to finalize GDPR compliance before the new legislation’s enforcement on 25 May 2018. What feels like a million emails were sent with updated privacy policies and requests for continued subscription. But now that the dreaded deadline is here, how will companies fare in this brave new GDPR-compliant world? Let’s have a look at some of the key factors to consider.
A country by country caseAs a regulation, the GDPR is applicable across all member states without the need for each country to pass national laws. However, each member state has its own data protection laws which will need to be aligned to the GDPR.
The new regulation also contains more than 70 opening clauses which allow member countries to modify the provisions set within them to implement stricter or laxer rules than those set out …
Read more
The region’s number one information security event, Infosecurity Europe 2018, is back at the Olympia in London this June and the Endpoint Protector team wouldn’t miss it for the world. Over the years, Infosec Europe has become one of the essential stops on our DLP experts’ annual global itinerary. With the most comprehensive conference programme in the region, over 400 exhibitors showcasing their solutions and products, and 19,500+ information security professionals in attendance, how could it not be?
This year, attendants can choose from 240+ free to attend conference sessions led by industry influencers that address some of the information security sector’s biggest concerns: how to build the cybersecurity team of the future, what AI and quantum computing mean for information security, how information security can add value to digital transformation, and third-party…
Read more
The Clarifying Lawful Overseas Use of Data (CLOUD) Act was signed into law by the US President on March 23rd as part of the 2,000-page Spending Bill. The new piece of legislation addresses a controversial debate that has been raging in the US since the notorious United States v. Microsoft case, in which the tech giant refused to hand over data stored on its Irish servers to the FBI, first made headlines: can US law enforcement officials request access to data stored in another country by a company operating in the US?
CLOUD settles the argument firmly on the side of law enforcement by making it easier for them, whether they are local police or federal forces, to directly request that US tech companies hand over data regardless of where it is stored. The executive branch will also now have the power to sign executive agreements with foreign governments that want access to data stored in the US, all…
Read more
As we enter the home stretch towards the enforcement of the EU’s General Data Protection Regulation (GDPR), with only three weeks to go until 25 May 2018, we take a closer look at one of the key requirements of the new legislation: Data Protection Impact Assessments (DPIAs).
Meant to help companies identify, assess and minimize the data protection risks of projects, DPIAs are not necessarily a new idea. A similar concept, Privacy Impact Assessments (PIAs), have been widely considered to be valuable tools for companies looking to reduce risks resulting from their data processing activities. However, because of the lack of an industry-wide agreement on how these should be conducted, companies have often found themselves at a loss when it came to carrying them out.
Through DPIAs, the GDPR has now made assessments mandatory by law in the case of processing activities which may result…
Read more
The French data protection authority, the Commission Nationale de l’Informatique et des Libertés (CNIL) has taken a very active role in clarifying what French businesses’ responsibilities will be under the EU’s General Data Protection Regulation (GDPR), coming into force on 25 May 2018. Issuing everything from guidelines for processors and SMEs to toolkits and templates, CNIL has taken a hands-on approach to demystifying the GDPR and providing clear steps towards achieving compliance.
The French DPA sees the GDPR as having a strong focus on accountability and transparency which are reflected in the regulation’s emphasis on creating products and services that take into consideration data protection by design and by default as well as the establishment of internal policies, procedures and tools that guarantee an optimal protection of individuals’ personal…
Read more
Data has become ubiquitous: from business processes and applications to smart phones, tablets and printers, the places data is stored and processed have moved beyond the confines of traditional network infrastructure and, implicitly, outside its protection mechanisms.
As a consequence, data breaches have become increasingly common, leading to a global movement towards the adoption of stricter regulations for the protection of users’ personal data. Notably, the EU’s General Data Protection Regulation (GDPR) is seen as a trailblazing legislation that enforces individuals’ rights and makes companies accountable for the security of the data they process.
But while compliance is important to avoid fines, the threat of data breaches should be a wake-up call to all companies, no matter which country they operate from or where their customers are located. As seen daily in…
Read more
Time is ticking: the implementation of the EU’s General Data Protection Regulation (GDPR) is less than 7 weeks away and companies are still struggling to come to terms with compliance. While some have already passed their audits and feel confident as we draw nearer to finding out the full extent of the GDPR’s enforcement, others are just now taking the first precautionary steps towards compliance.
Among the many requirements organizations must comply with, the right to erasure is one of the thorniest. A recent survey by big data application provider Solix found that 65% of respondents were unsure whether their companies can fully and permanently purge personal information from their systems. But what does the right to erasure imply, who does it apply to and, more importantly, what must companies do to comply with it? Let’s find out!
The right to be forgotten and the right to erasure…Read more
With the GDPR implementation around the corner, companies processing EU data subjects’ personal information need to step up their data protection policies and take decisive action to reach compliance. Under the new legislation, organizations will no longer have the luxury of putting data security low on their priorities list or feign ignorance about their data processing practices. They will be held accountable in the eyes of the law and will have to demonstrate their compliance with GDPR requirements to data protection authorities.
One of the first steps companies must take in this direction is to become aware of the way data is handled within their organizations. This implies a deep understanding of EU data subjects’ rights as well as the principles enshrined in the GDPR that relate to the processing of personal data.
Under the GDPR, sensitive information must be processed…
Read more
Earlier this week, the Center for Internet Security (CIS) released the latest version of their Top 20 Critical Security Controls, a ground-breaking set of globally recognized best practice guidelines for securing IT systems and data. The Critical Security Controls were first developed by the SANS Institute in 2008 and were later transferred to CIS in 2015. The guidelines are continuously being revised and refined by a volunteer global community of experienced IT professionals.
The Six Basic ControlsMost major security incidents occur when even basic controls are lacking or are poorly implemented. A study of the previous version of the controls showed that 85% of cyberattacks can be prevented by the adoption of the then first five Critical Security Controls alone. Applying all twenty can prevent as much as 97% of attacks.
The first six controls were therefore developed…
Read more
With the implementation of the EU’s General Data Protection Regulation (GDPR) 10 weeks away, organizations are struggling to reach compliance before the deadline passes. The new legislation is meant to unify and standardize data protection regulations across the EU, simplifying compliance procedures across borders and giving EU data subjects an unprecedented level of control over their personal data.
For the first time, privacy, in its digital context, will be legally enforced by design and by default. Companies will be held responsible for any breach of privacy and hefty fines will be applied to data controllers and processors found to not have taken adequate measures to protect EU data subjects’ personal information.
The GDPR brings one additional significant change to its predecessor: certain companies will have to appoint a Data Protection Officer (DPO). But what …
Read more