In May 2018, the General Data Protection Regulation (GDPR) comes into effect. It is a regulation introduced by the European Commission in order to strengthen EU citizens’ rights to protection of personal data. The GDPR affects all companies who collect and use personal data of EU individuals— regardless of whether the company itself is located in the EU. Critical to compliance is to prevent unauthorized access to sensitive information and audit and monitor all user activity — which are key functionalities of Safewhere’s Identity and Access Management platform. We can help you achieve compliance with important requirements of the GDPR.
Potential fines for noncompliance as high as 4% of your annual global revenue is an important argument for why you need to make GDPR compliance a top priority, but showing that you are able to create trusted relationships with partners, customers, and citizens is also a great opportunity for your company to differentiate itself.
What are the key changes?
Privacy by design and privacy by default
In short, privacy by design means that any new service or process must take protection of personal data into consideration. This requires companies to take privacy into account from the very beginning of any project, and protect personal data throughout its entire life cycle.
Privacy by default means that wherever possible, the collection of personal data must be limited to what is necessary for the specified purposes.
Right to be forgotten
EU individuals have the right to demand that their personal data is deleted if it is no longer necessary to the purpose for which it was collected. This is known as the “right to be forgotten”. Under this rule, they can also demand that their data is erased if they have withdrawn their consent for their data to be collected, or object to the way it is being processed.
Breach notification
One of the key new changes under the GDPR is the right of EU individuals to be notified if their data has been breached or compromised and that data poses “a high risk to their rights and freedoms.” Companies are also required to notify data protection authorities within 72 hours of a breach occurring. This will be a huge challenge to many companies as at present the average breach takes over 200 days to detect.
What data is regulated?
The GDPR regulates collection, processing, and storage of personal data of EU individuals.
The GDPR expands the definition of personal data substantially, so that it now includes any information that can be connected to a specific EU individual. This can be anything from a name, a photo, or an e-mail address to less obvious information, such as a computer’s IP address, medical information, and location data.
What you need to do
GDPR compliance will require comprehensive changes to your policies, processes and maybe even systems.
Data classification
You have to know where personal data is stored on your systems. Don’t forget data stored in unstructured formats in documents, presentations, and spreadsheets. This is critical for both protecting the data and following through on requests to correct and erase personal data.
Meta data
With GDPR requirements for limiting data collection, you will need to store basic information on when the data was collected, why it was collected, and for what purpose. Personal data residing in your IT systems should be reviewed periodically to see whether it needs to be saved for the future or deleted.
Data governance
With privacy by design and by default, you should focus on data governance basics. For both structured and unstructured data, this should include understanding who is accessing personal data in your systems, who should be authorized to access, and limiting the permissions based on the employee’s actual role(s), that is, role-based access control.
Monitoring
The breach notification requirement places a new burden on data controllers. Under the GDRP, the IT security mantra should be always monitor. You need to be able to spot unusual access patterns against systems containing personal data and to report an exposure to the local data authority.
How we can help you
One identity
To help you control who is accessing what personal data, with Safewhere’s platform, you can allow users to sign in with a domain account such as Active Directory, while you can let all external user groups—suppliers, partners, customers, citizens—sign in with their own authentication method to your on-premises and cloud applications. This will help you comply with articles 25, 30, and 32 of the GDPR.
Adaptive authentication
To improve access security, Safewhere also enables you to request users to sign in with one or more additional authentication factors (multifactor authentication) based on the data classification of the application they are trying to access and the users’ location. This can be multifactor authentication through e-mail or SMS or using a third-party solution such as Yubico, Google Authenticator, or Gemalto. Due to the flexible architecture of the Safewhere platform, any MFA solution can be used. This will help you comply with articles 25,30, and 32 of the GDPR. Learn more about our platform’s multi-factor authentication and adaptive authentication features.
Access governance
With our user provisioning functionality, you can control what users have access to: which applications and what data. When a new employee joins your organization, user provisioning helps you make sure that he or she has the correct access rights to the applications needed. When that employee leaves the organization, all access rights will be immediately revoked and the user account will be disabled. The Safewhere platform provides a complete, real-time view of what users have access to and which applications. This will help you ensure compliance with articles 25,30, and 35 of the GDPR.
Monitoring and audit
Using our extensive logging, you can monitor in real time on which users are accessing what applications. Due to the flexible architecture of the platform, any monitoring system can be used. When you have been subjected to a data breach, you can use the logging features to generate an audit report of who accessed what application at any given time and location. This will help you comply with articles 30 and 33 of the GDPR.
mv,,b,bvm,mvm,
The GDPR and Identity and
Access Management
Some recommendations from an Identity
and Access Management point of view on
how to prepare for GDPR compliance
jffkj