COMPLIANCE

General Data Protection Regulation (GDPR)

Our right to integrity is a human right. Just as we have the right to lock our front door to protect ourselves from burglars, we have the right to privacy online. We decide whom we want to welcome into our house. The EU Charter of Fundamental Rights stipulates that everyone in the EU has the right to protect their personal data and get access to data collected and the right to have it rectified. But new technology has eroded this human right, and companies continuously collect data for their own purposes.

Consistency & Increased Security

General Data Protection Regulation or GDPR came into force on May 25th, 2018. GDPR aims to create coherence around the management of personal data within the EU. Because data protection is an essential part of GDPR, it has had a significant impact on the importance of protecting personal data, especially from a cyber security perspective.

Continuous Evaluation of Cyber Security

Higher security demands and structured security management are necessary to assure proper personal data protection. Each organization must continuously ensure systems that handle or store personal data. Since most IT environments are a network of computers, servers, etc., interconnected in different ways, organizations must ensure security throughout their entire IT environment.

compliance advice online person working

The Seven Principles of GDPR

yellow icon book section light

Lawfulness, Fairness, & Transparency

You may only process personal data if you meet the requirements of the law.

yellow icon user lock light

Integrity & Confidentiality

Personal information must be stored securely, not altered or stolen.

yellow icon database light

Data Minimization

You may only collect the information that is necessary to fulfill the purpose.

yellow icon crosshairs light

Accuracy

If you have personal information, you must keep it correct and up to date.

yellow icon trash can clock light

Storage Limitation

Data should not be kept longer than needed and should be deleted.

yellow icon triangle exclamation light

Purpose Limitation

You may only collect personal data for a specified purpose.

yellow icon ballot check light

Accountability

You must be able to prove that you meet all these requirements.

Framework for Increased Security Audits

GDPR requires a combination of technology, processes, procedures, and people working together to guarantee personal data privacy. IT departments need to establish security strategies and use them as a framework to prevent, monitor and manage any data breaches. This includes developing policies and procedures to train employees to handle data correctly.

  • Establish processes and systems to identify possible signs of intrusions or security irregularities and notify and report these instances.
  • Implement preventive security systems such as firewalls and IDS (Intrusion Detection System).
  • Monitor users with administrator privileges to detect discrepancies or deviant behaviors.
  • Establish security policies that facilitate continuous monitoring of activities to detect irregularities or unauthorized access to personal data.
  • Otherwise, ensure that your organization has sufficient protection for the organization’s network against threats such as unauthorized intrusion, removal, and sharing, as well as copying and attempting to copy information.
Lady justicet. Statue of Jusice on sky background

Financial Fines

yellow icon arrow right

British Airways

Lack of security led to hackers stealing information from about 400,000 customers. British Airways had to pay €3,2 million in financials fines.

yellow icon arrow right

Capio St. Göran

The hospital’s information system was not adequately secured and ignored the principle of minimum access, which gave users full access to all patient data, including sensitive information. Capio St. Göran had to pay €22,4 million in financials fines.

yellow icon arrow right

Mariotte

Lack of security led hackers to steal 339 million customers’ data. Thirty-one million were EU residents. Mariotte had to pay €20,4 million in financial fines.

Facts About GDPR

  • GDPR (General Data Protection Regulation) is an EU-homogeneous regulation.
  • It has been implemented as a local law in each EU member state and replaced any previous local laws.
  • It was launched across the EU on May 25th, 2018.
  • The legislation aims to create coherence around the management of personal data within the EU and increase security.
  • In the case of a personal data breach, the controller shall notify the personal data breach supervisory authority without delay no later than 72 hours after becoming aware of it.
  • Penalties for non-compliance are either up to €10 million, or 2% annual global turnover – whichever is higher or up to €20 million, or 4% annual global turnover – whichever is higher. The fines are based on the specific articles of the regulation that has been breached.
EU flags in front of the Berlaymont building
NEXT-GEN VULNERABILITY MANAGEMENT

Meet Laws & Recommendations

Strengthen your cyber security defense and ensure compliance with laws and recommendations. Our platform enables you to discover technical and human vulnerabilities, evaluate and prioritize risks, and address vulnerabilities throughout your IT environment.