What is General Data Protection Regulation (GDPR)

My InfoTech Journal:

General Data Protection Regulation (GDPR)

The General Data Protection Regulation, also known as GDPR is regulation under the European Union (EU) Law that mandates data security and privacy.

The General Data Protection Regulation (GDPR) was passed by the European Parliament in 14-Apr-2016 and which became effective on 25-May-2018.

The main objective of GDPR is to ensure that individuals under the European Economic Area (EEA) have control and rights over their personal information. The GDPR also aims to simplify the regulatory requirements for international business.

GDPR Protection Principles ¹

Lawfulness, fairness and transparency — Processing must be lawful, fair, and transparent to the data subject.

Purpose limitation — You must process data for the legitimate purposes specified explicitly to the data subject when you collected it.

Data minimization — You should collect and process only as much data as absolutely necessary for the purposes specified.

Accuracy — You must keep personal data accurate and up to date.

Storage limitation — You may only store personally identifying data for as long as necessary for the specified purpose.

Integrity and confidentiality — Processing must be done in such a way as to ensure appropriate security, integrity, and confidentiality (e.g. by using encryption).

Accountability - The data controller is responsible for being able to demonstrate GDPR compliance with all of these principles.

GDPR Checklist for Data Controllers

This section was taken from the GDPR Checklist.

Lawful Basis and Transparency:

Conduct an information audit to determine what information you process and who has access to it.
Have a legal justification for your data processing activities.
Provide clear information about your data processing and legal justification in your privacy policy.

Data Security:

Take data protection into account at all times, from the moment you begin developing a product to each time you process data.
Encrypt, pseudonymize, or anonymize personal data wherever possible.
Create an internal security policy for your team members, and build awareness about data protection.
Know when to conduct a data protection impact assessment, and have a process in place to carry it out.
Have a process in place to notify the authorities and your data subjects in the event of a data breach.

Accountability and Governance

Designate someone responsible for ensuring GDPR compliance across your organization.
Sign a data processing agreement between your organization and any third parties that process personal data on your behalf.
If your organization is outside the EU, appoint a representative within one of the EU member states.
Appoint a Data Protection Officer (if necessary)

Privacy Rights

It's easy for your customers to request and receive all the information you have about them.
It's easy for your customers to correct or update inaccurate or incomplete information.
It's easy for your customers to request to have their personal data deleted.
It's easy for your customers to ask you to stop processing their data.
It's easy for your customers to receive a copy of their personal data in a format that can be easily transferred to another company.
It's easy for your customers to object to you processing their data.
If you make decisions about people based on automated processes, you have a procedure to protect their rights.

Security Controls for General Data Protection Regulations (GDPR)

Identity and Access Management (IAM)

Identity and Access Management (IAM) is the discipline that enables the right individuals to access the right resources at the right times for the right reasons. 3

This simply means that only those who are authorized to have access to personal information on a need to know basis based on the job role will be granted access.

Access permission will have to comply with Segregation of Duties and of Least Privilege access level requirement to perform their job responsibilities.

Data Loss Protection (DLP)

Data Loss Protection (DLP) describes a set of technologies and inspection techniques used to classify information content contained within an object — such as a file, email, packet, application or data store — while at rest (in storage), in use (during an operation) or in transit (across a network). DLP tools are also have the ability to dynamically apply a policy — such as log, report, classify, relocate, tag and encrypt — and/or apply enterprise data rights management protections. 3

Data Loss Protection solutions add a layer of protection to secure information while at rest (data in storage or repository), in use (while data is being processed), and in transit (while data is transferred from one location to another).

How does a DLP solution work?

These are some of the policies within a DLP Tool that needs to be reviewed and configured to trigger an alert when a policy violation is detected.

The following is taken from the McAfee DLP Solution ⁴

Rule-Based/Regular Expressions: The most common analysis technique used in DLP involves an engine analyzing content for specific rules such as 16-digit credit card numbers, 9-digit U.S. social security numbers, etc. This technique is an excellent first-pass filter since the rules can be configured and processed quickly, although they can be prone to high false positive rates without checksum validation to identify valid patterns.
Database Fingerprinting: Also known as Exact Data Matching, this mechanism looks at exact matches from a database dump or live database. Although database dumps or live database connections affect performance, this is an option for structured data from databases.
Exact File Matching: File contents are not analyzed; however, the hashes of files are matches against exact fingerprints. Provides low false positives although this approach does not work for files with multiple similar but not identical versions.
Partial Document Matching: Looks for complete or partial match on specific files such as multiple versions of a form that have been filled out by different users.
Conceptual/Lexicon: Using a combination of dictionaries, rules, etc., these policies can alert on completely unstructured ideas that defy simple categorization. It needs to be customized for the DLP solution provided.
Statistical Analysis: Uses machine learning or other statistical methods such as Bayesian analysis to trigger policy violations in secure content. Requires a large volume of data to scan from, the bigger the better, else prone to false positives and negatives.
Pre-built categories: Pre-built categories with rules and dictionaries for common types of sensitive data, such as credit card numbers/PCI protection, HIPAA, etc.

Encryption

Encryption is the process of systematically encoding a bit stream before transmission so that an unauthorized party cannot decipher it. 4

Pseudonymization

Pseudonymization is “the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information”. 5

Incident Management for GDPR

Incident Management as defined by GDPR refers to “Breaches of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.” 2

GDPR mandates that organizations report data breaches to the relevant supervisory authority within 72 hours of becoming aware of the data breach. Failure to do so will require an explanation.

If the data breach is high risk and will adversely affect the individual’s rights and freedom, everyone affected must be notified without undue delay.

Disclaimer

This article is my personal research and is not a substitute for legal advise.
Please consult your Legal Team for the interpretation of Data Privacy Law specific requirements.

End Notes

Disclaimer

This article is a result of my personal research and is not a substitute for legal advise.

Please consult your Legal Team, Ethics & Compliance, or Regulatory Team for the interpretation of specific CyberSecurity requirements.

My InfoTech Journal

Search This Blog