The General Data Protection Regulation (GDPR) goes to great lengths to provide control to users concerning their personal data. It requires organizations, both data controllers and processors, to have appropriate mechanisms to guarantee that all personal data is adequately protected.
The term “appropriate” indicates that Article 32 of the GDPR does not require absolute security. More specifically, Article 32 of the GDPR requires organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Data controllers and processors must consider certain factors to determine whether or not a particular security control is appropriate in the given circumstances.
Factors To Decide Appropriate Technical & Organizational Measures
As per Article 32 of the GDPR, technical and organizational measures undertaken by an organization for data security must depend on the following factors:
- State of the art - The first factor, “state of the art,” refers to the industry's best practices. The GDPR recognizes that security is a domain of professional expertise. It leaves it to data controllers and processors to consider industry best practices while devising appropriate security controls in a given situation.
- Costs of implementation - The second factor, “costs of implementation,” indicates that security controls must consider the costs of implementing security controls in a given situation. It means data controllers and processors are not required to implement exorbitantly expensive controls. Organizations must remain cost-determinative, consider industry best practices and implement the security control appropriate to their situation and circumstances.
- Nature, scope, context, and purposes of processing - To determine appropriate controls, organizations must consider the nature of the data that is to be processed as well as the context in which the processing takes place, the purposes of the processing and the scope of the processing. Higher probabilities or higher impact threats will require organizations to employ tighter controls, especially while processing sensitive personal data.
- Risk to the rights and freedoms of natural persons - To determine appropriate controls, organizations must undertake risk assessments to identify any reasonable foreseeable threats and risks to the data subjects. The security control must be appropriate to the identified risks.
In any case, organizations must be proactive in taking measures that afford appropriate safeguards to all collected data. Due to just how dynamic the world of data privacy can be, organizations are expected to ensure that their practices and security measures are dynamic and up to date with modern standards and industry best practices.
Let’s look into the express security measures mentioned in the GDPR.
Pseudonymization of Data
The purpose behind undertaking this measure is to ensure the risk of the exposed processed data is minimal.
Pseudonymization of data can be done by replacing data subjects' names and unique identifiers with the use of additional information such as reference numbers. This additional information can then be used to cross-reference and keep track of the users' data. Pseudonymization reduces the risks to the data subjects concerned. Pseudonymized data is also considered personal data under the GDPR and will therefore be subject to data protection requirements of the GDPR.
Encryption of Data
Encryption is another express control of the GDPR. Where data is encrypted, it becomes unreadable without access to a decryption key or cipher. Encryption makes personal data unintelligible to anyone who is not authorized to access the data. As a result, it mitigates the risks inherent in the data processing activity.
The Ability To Ensure The Ongoing Confidentiality, Integrity, Availability & Resilience of Personal Data
Pseudonymisation and encryption are the only two express controls mentioned in the GDPR. The GDPR requires data controllers and processors to implement security controls that ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
- Confidentiality indicates that data access is permitted on a need-to-know basis.
- Integrity means the data remains accurate and complete.
- Availability means data remains accessible when needed for a business activity.
- Resilience means data is able to withstand and recover from errors or threats.
The organization will need to implement a blend of operational and technical measures to guarantee personal data confidentiality, integrity, availability, and resilience.
Restoration of availability and access to data
Suppose an organization undertakes all the necessary precautions and has the best security protocols, and a data incident occurs anyway. Several contingency plans will come into effect. These plans aim to restore access to personal data as soon as possible in case of a breach.
The GDPR requires controllers and processors to implement controls that can promptly restore the availability and access to personal data in case of a physical or technical incident.
One of the ways to do so is via maintaining an offsite backup that an organization can switch to seamlessly in the event of a data incident. Similarly, the incident response plan must also contain a detailed overview of all necessary steps to be taken to ensure a prompt switch to backups.
Regular Testing of Effectiveness of the Adopted Measures
The GDPR requires data controllers and processors to have a process for regular testing, assessing, and evaluating the effectiveness of the technical and organizational measures for ensuring the security of the processing.
Adopting and implementing effective technical and organizational measures is the first step toward appropriately protecting all collected data. However, it is equally necessary to continuously assess the effectiveness of these measures by running consistent risk assessments.
Consistent risk assessments allow an organization to review these measures over time and gain insights on how their effectiveness can be improved or which technological aspect of these measures has become redundant.
Similarly, it allows an organization to scale its measures depending on its organizational structure. In such cases, prompt and proactive changes to security measures can help an organization always keep its practices up to date.
These risk assessments can include scheduled penetration tests, periodic audits, and vulnerability scans.
Risk Assessment
Controllers and processors must act to limit risks of insecurity or risks of a breach. As per Article 32(2) of the GDPR, organizations must consider the risks presented by data processing while assessing the appropriate level of data security. A perfect risk assessment must consider all the factors mentioned above to select an appropriate security measure.
How Can Securiti Help
Data has always been an invaluable asset. However, its volume has risen exponentially over the past few years owing to leaps in technology and the need for organizations to more effectively target potential customers. Data is the north star that determines what strategic direction organizations will take.
However, at the same time, users online have become far more vigilant and informed about their data rights. Naturally, they’re more apprehensive about sharing their valuable data with organizations. Hence, robust and proactive security measures are critical if an organization wants its users to trust it with their data.
Securiti can help organizations in that regard.
Securiti’s Data Intelligence enables organizations to understand data risk profiles, identify emerging risk areas and implement appropriate controls relevant to the particular kind of data processing. This allows controllers and processors to have technical security controls in place to ensure an appropriate level of data security.
Securiti has made a name for itself in data governance, and compliance by providing reliable solutions to organizations for their data privacy needs, such as DSR automation, data classification, vendor risk assessment, and breach management, among others.
Request a demo today to learn more about how Securiti can help your organization's GDPR compliance.
