Rule 3 of 4

You collect as little as possible (rule 1) and you communicate transparently about it (rule 2). The data you do have, you must secure well.

Security

Protect personal data with technical and organisational measures against unauthorised access, loss, or damage.

A holistic approach

Security is a broad subject and only works with a holistic approachinfo Holistic approach Looking at security as a whole: technology, people, and organisation together. One isolated measure is not enough; every link in the chain must hold. Data security: where to start?arrow_forward .

You cannot do “a bit” of security: your defence is only as strong as the weakest link.

That is why we look at security on four fronts:

• System and software securityinfo System and software security Secure your systems and software: strong logins and passwords, limited access rights, and regular backups. Security for systems and softwarearrow_forward : logins, passwords, access rights, and backups.
• Data securityinfo Data security Protect the data itself, mainly through encryption, both at rest and in transit. Encryption: do I need to encrypt?arrow_forward : encryption at rest and in transit.
• Environmental securityinfo Environmental security The physical environment counts too: limit access to offices, filing cabinets, and printers, and keep paper records under lock and key. Data security for paper documentsarrow_forward : physical access to offices, cabinets, and printers.
• The human factorinfo The human factor Most data breaches start with employees: a wrong click, a lost laptop. Awareness and training are therefore essential. Why data breaches start with employeesarrow_forward : awareness, because people are often the weakest link.

System and software security menu_bookKnowledge Base

• Secure everything with a login; require strong passwordsinfo Strong passwords At least 12 characters, never reused, and stored in a password manager, no post-its or shared spreadsheets. Change passwords after a breach, not on a fixed schedule. Password policy: best practicearrow_forward and turn on 2FA where possible.
• Do not share accounts: give every employee their own login. That way you know who did what and you can revoke access in a targeted way.
• Keep all software up to date: most cyber attacks exploit known vulnerabilities that an update would have fixed.
• Limit user rightsinfo Limiting user rights Give everyone only the access strictly necessary for the job (the 'least privilege' principle). Also review those rights periodically; people change roles or leave. Periodic access reviewsarrow_forward to what is strictly necessary, with periodic reviews.
• Make sure you have regular backups against accidental loss of data.

Data and environmental security

The human factor menu_bookKnowledge Base

People are often the weakest link: someone clicks on a malicious link, leaves a laptop on the train, or emails the wrong attachment to everyone.

That is why awareness and training are essential; technology alone is not enough.

The laptop on the train

What do you do if it does go wrong? Read what a data breach is and what to doinfo Data breach A data breach is any incident where personal data is lost or ends up in the wrong hands: a lost laptop, a hacked mailbox, a file sent to the wrong recipient. You often have to report within 72 hours. Data breach: what it is and what to doarrow_forward .

”Everyone can access everything”

What you take away from module 5

Module 5 complete 🎉

You now know how to protect personal data technically and organisationally. In module 6 we close out the four rules with the rights of data subjects.