IDC Names Securiti a Worldwide Leader in Data PrivacyView
The General Data Protection Regulation (GDPR) goes to great lengths to provide control to users concerning their personal data. It requires organizations, both data controllers and processors, to have appropriate mechanisms to guarantee that all personal data is adequately protected.
The term “appropriate” indicates that Article 32 of the GDPR does not require absolute security. More specifically, Article 32 of the GDPR requires organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Data controllers and processors must consider certain factors to determine whether or not a particular security control is appropriate in the given circumstances.
As per Article 32 of the GDPR, technical and organizational measures undertaken by an organization for data security must depend on the following factors:
In any case, organizations must be proactive in taking measures that afford appropriate safeguards to all collected data. Due to just how dynamic the world of data privacy can be, organizations are expected to ensure that their practices and security measures are dynamic and up to date with modern standards and industry best practices.
Let’s look into the express security measures mentioned in the GDPR.
The purpose behind undertaking this measure is to ensure the risk of the exposed processed data is minimal.
Pseudonymization of data can be done by replacing data subjects' names and unique identifiers with the use of additional information such as reference numbers. This additional information can then be used to cross-reference and keep track of the users' data. Pseudonymization reduces the risks to the data subjects concerned. Pseudonymized data is also considered personal data under the GDPR and will therefore be subject to data protection requirements of the GDPR.
Encryption is another express control of the GDPR. Where data is encrypted, it becomes unreadable without access to a decryption key or cipher. Encryption makes personal data unintelligible to anyone who is not authorized to access the data. As a result, it mitigates the risks inherent in the data processing activity.
Pseudonymisation and encryption are the only two express controls mentioned in the GDPR. The GDPR requires data controllers and processors to implement security controls that ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
The organization will need to implement a blend of operational and technical measures to guarantee personal data confidentiality, integrity, availability, and resilience.
Suppose an organization undertakes all the necessary precautions and has the best security protocols, and a data incident occurs anyway. Several contingency plans will come into effect. These plans aim to restore access to personal data as soon as possible in case of a breach.
The GDPR requires controllers and processors to implement controls that can promptly restore the availability and access to personal data in case of a physical or technical incident.
One of the ways to do so is via maintaining an offsite backup that an organization can switch to seamlessly in the event of a data incident. Similarly, the incident response plan must also contain a detailed overview of all necessary steps to be taken to ensure a prompt switch to backups.
The GDPR requires data controllers and processors to have a process for regular testing, assessing, and evaluating the effectiveness of the technical and organizational measures for ensuring the security of the processing.
Adopting and implementing effective technical and organizational measures is the first step toward appropriately protecting all collected data. However, it is equally necessary to continuously assess the effectiveness of these measures by running consistent risk assessments.
Consistent risk assessments allow an organization to review these measures over time and gain insights on how their effectiveness can be improved or which technological aspect of these measures has become redundant.
Similarly, it allows an organization to scale its measures depending on its organizational structure. In such cases, prompt and proactive changes to security measures can help an organization always keep its practices up to date.
These risk assessments can include scheduled penetration tests, periodic audits, and vulnerability scans.
Controllers and processors must act to limit risks of insecurity or risks of a breach. As per Article 32(2) of the GDPR, organizations must consider the risks presented by data processing while assessing the appropriate level of data security. A perfect risk assessment must consider all the factors mentioned above to select an appropriate security measure.
Data has always been an invaluable asset. However, its volume has risen exponentially over the past few years owing to leaps in technology and the need for organizations to more effectively target potential customers. Data is the north star that determines what strategic direction organizations will take.
However, at the same time, users online have become far more vigilant and informed about their data rights. Naturally, they’re more apprehensive about sharing their valuable data with organizations. Hence, robust and proactive security measures are critical if an organization wants its users to trust it with their data.
Securiti can help organizations in that regard.
Securiti’s Data Intelligence enables organizations to understand data risk profiles, identify emerging risk areas and implement appropriate controls relevant to the particular kind of data processing. This allows controllers and processors to have technical security controls in place to ensure an appropriate level of data security.
Securiti has made a name for itself in data governance, and compliance by providing reliable solutions to organizations for their data privacy needs, such as DSR automation, data classification, vendor risk assessment, and breach management, among others.
Request a demo today to learn more about how Securiti can help your organization's GDPR compliance.
At Securiti, our mission is to enable enterprises to safely harness the incredible power of data and the cloud by controlling the complex security, privacy and compliance risks.
300 Santana Row Suite 450. San Jose,