The GDPR does not list products to buy. It requires security measures that fit the risks. For a data protection officer (DPO), two articles are the starting point.
Article 32: appropriate measures
Article 32 requires technical and organisational measures appropriate to the risk. It mentions in particular:
- pseudonymisation and encryption of personal data;
- the ability to ensure the confidentiality, integrity, availability and resilience of systems;
- the ability to restore access to personal data quickly after an incident;
- a process for regularly testing, assessing and evaluating how effective these measures are.
The last point is often the most neglected. A measure that is never tested cannot be demonstrated.
Article 33: notifying a breach
When a personal data breach occurs, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Notification is not required if the breach is unlikely to result in a risk to individuals.
The text also requires every breach to be documented, including those that are not notified. A simple, maintained register is worth more than memory.
A realistic plan
- Know where the data is. An inventory of processing activities and processors is the basis for everything else.
- Prepare detection. Who receives the alert, at what time, and who decides that a breach has occurred.
- Write the notification procedure. A message template, the person who signs, the channel to the authority.
- Test it. A simple exercise once a year reveals weak points before a real incident.
Personal data exposed on the Internet without anyone knowing is a common case. An outside view of the organisation’s domains helps find it. Atlas is in development for this use.