Book demo
mobile-logo
 

Blog

EU data protection

How to Prepare for the New EU Data Protection Regulation?

August 2, 2016
IAM insights
Reading Time: 3 minutes

A new and stricter EU data protection framework – the General Data Protection Regulation (GDPR) – comes into force in less than two years.
But how will the GDPR affect your business and what can you do to prepare for it? In this article, we provide an overview of some of the highlights in the GDPR and explain how Identity and Access Management (IAM) can help you close security gaps and ensure compliance.

The GDPR aims to give citizens back control of their personal data and create a high, uniform level of data protection across the EU by forcing companies and organizations to gain a complete overview and control over their entire data life cycle.The GDPR is expected to come into force in May of 2018 and will require compliance of all companies and organizations whose activities relate to the offering of goods or services in the EU and who monitor and store data about EU customers, citizens, and stakeholders.

This means that if your organization needs to store personal data about customers, users, or other stakeholders, you must determine an approach for complying with the GDPR. How you protect this data is directly related to your organization’s reputation, legal responsibility, and financials.

In the worst cases, a data breach will mean high penalties: 4% of the global annual turnover for the preceding financial year or up to 20 million euro.

There are some key areas that you need to start focusing on now to ensure that you comply with the new requirements:

  • The GDPR tightens the rules for obtaining valid consent to use personal data.
    You must be able to prove clear and affirmative consent to any personal data that you process.
  • The GDPR requires public organizations and certain private companies to appoint a data protection officer.
    You must make sure that someone in your organization, or an external data protection advisor, takes proper responsibility for your data protection compliance and has the knowledge, support, and authority to do so.
  • The GDPR introduces “the right to be forgotten.”
    You must not hold data for any longer than absolutely necessary, and are not allowed to use it for other purposes than for which it was originally collected. At the same time, you must delete any data at the request of the data subject.
  • The GDPR requires privacy by design and privacy by default.
    You must ensure that privacy is embedded into any new process or software product that you deploy and establish a culture of monitoring, reviewing, and assessing your data processing procedures.
  • The GDPR enhances data breach notifications requirements.
    You must establish clear policies and procedures to ensure that you can react quickly to any data breach and notify national authorities.
  • The GDPR places accountability obligations on data controllers to demonstrate compliance.
    You must ensure that you have clear policies in place to prove that you meet the required standards. You should be able to document what data you hold, where it came from, and who you share it with.

What Can I Do to Prepare?

Basically, you need to make sure that any personal data that you collect is only used for the purposes that you have outlined in your privacy statement and is only accessible to individuals who are granted explicit privileges to it.

To ensure this, you have two main types of access conditions to consider; internal access and external access:

  • The internal access requirement means that the collected data can’t be available to all your employees. Only those who have a valid reason should have access to it. This typically means that certain people within your organization are authorized to view and work with the data.
  • The external access requirement means that you should be able to grant your users access to their own data, but that this data should be well protected from others. For example, having a social logon to a data set containing credit rating information, Social Security numbers, and so forth is – obviously – a bad idea.

Ensuring control of all your users and their access to applications and monitoring access and data usage is exactly the essence of what Identity and Access Management is all about. An Identity and Access Management solution basically contains these four elements:

  • Identifying users
  • Controlling user access
  • Determining user privileges
  • Delegating administrative authorities

We might be biased, but in our opinion, there is no question that if you want to be prepared for complying with the GDPR (and for many other reasons), you should start looking into Identity and Access Management.

Need any advice on how to get started with IAM or simply want to know more about the subject? Don’t hesitate to contact Safewhere at:

+45 7199 9007 or info@www.safewhere.com

Share

Related Posts

After 2017’s Many Data Breaches – How to Protect Your Company’s Identities
Woman using login interface on touch screen

Digital Authentication: The Influence of Content and Context
Two business people shaking hands over coffee table

How to Make B2B Collaboration More Efficient and Secure

Five Ways for Companies to Improve Security in the Cloud
We use cookies to collect statistical information in order to improve the website and user experience to match the needs of the majority. You can always delete the saved cookies in your browser settings.
Cookies settings
Accept
Privacy & Cookie policy
Privacy & Cookies policy
Cookies list
Cookie name Active

Privacy Policy

What information do we collect?

We collect information from you when you register on our site or place an order. When ordering or registering on our site, as appropriate, you may be asked to enter your: name, e-mail address or mailing address.

What do we use your information for?

Any of the information we collect from you may be used in one of the following ways: To personalize your experience (your information helps us to better respond to your individual needs) To improve our website (we continually strive to improve our website offerings based on the information and feedback we receive from you) To improve customer service (your information helps us to more effectively respond to your customer service requests and support needs) To process transactions Your information, whether public or private, will not be sold, exchanged, transferred, or given to any other company for any reason whatsoever, without your consent, other than for the express purpose of delivering the purchased product or service requested. To administer a contest, promotion, survey or other site feature To send periodic emails The email address you provide for order processing, will only be used to send you information and updates pertaining to your order.

How do we protect your information?

We implement a variety of security measures to maintain the safety of your personal information when you place an order or enter, submit, or access your personal information. We offer the use of a secure server. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our Payment gateway providers database only to be accessible by those authorized with special access rights to such systems, and are required to?keep the information confidential. After a transaction, your private information (credit cards, social security numbers, financials, etc.) will not be kept on file for more than 60 days.

Do we use cookies?

Yes (Cookies are small files that a site or its service provider transfers to your computers hard drive through your Web browser (if you allow) that enables the sites or service providers systems to recognize your browser and capture and remember certain information We use cookies to help us remember and process the items in your shopping cart, understand and save your preferences for future visits, keep track of advertisements and compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future. We may contract with third-party service providers to assist us in better understanding our site visitors. These service providers are not permitted to use the information collected on our behalf except to help us conduct and improve our business. If you prefer, you can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies via your browser settings. Like most websites, if you turn your cookies off, some of our services may not function properly. However, you can still place orders by contacting customer service. Google Analytics We use Google Analytics on our sites for anonymous reporting of site usage and for advertising on the site. If you would like to opt-out of Google Analytics monitoring your behaviour on our sites please use this link (https://tools.google.com/dlpage/gaoptout/)

Do we disclose any information to outside parties?

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information. This does not include trusted third parties who assist us in operating our website, conducting our business, or servicing you, so long as those parties agree to keep this information confidential. We may also release your information when we believe release is appropriate to comply with the law, enforce our site policies, or protect ours or others rights, property, or safety. However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.

Registration

The minimum information we need to register you is your name, email address and a password. We will ask you more questions for different services, including sales promotions. Unless we say otherwise, you have to answer all the registration questions. We may also ask some other, voluntary questions during registration for certain services (for example, professional networks) so we can gain a clearer understanding of who you are. This also allows us to personalise services for you. To assist us in our marketing, in addition to the data that you provide to us if you register, we may also obtain data from trusted third parties to help us understand what you might be interested in. This ‘profiling’ information is produced from a variety of sources, including publicly available data (such as the electoral roll) or from sources such as surveys and polls where you have given your permission for your data to be shared. You can choose not to have such data shared with the Guardian from these sources by logging into your account and changing the settings in the privacy section. After you have registered, and with your permission, we may send you emails we think may interest you. Newsletters may be personalised based on what you have been reading on theguardian.com. At any time you can decide not to receive these emails and will be able to ‘unsubscribe’. Logging in using social networking credentials If you log-in to our sites using a Facebook log-in, you are granting permission to Facebook to share your user details with us. This will include your name, email address, date of birth and location which will then be used to form a Guardian identity. You can also use your picture from Facebook as part of your profile. This will also allow us and Facebook to share your, networks, user ID and any other information you choose to share according to your Facebook account settings. If you remove the Guardian app from your Facebook settings, we will no longer have access to this information. If you log-in to our sites using a Google log-in, you grant permission to Google to share your user details with us. This will include your name, email address, date of birth, sex and location which we will then use to form a Guardian identity. You may use your picture from Google as part of your profile. This also allows us to share your networks, user ID and any other information you choose to share according to your Google account settings. If you remove the Guardian from your Google settings, we will no longer have access to this information. If you log-in to our sites using a twitter log-in, we receive your avatar (the small picture that appears next to your tweets) and twitter username.

Children’s Online Privacy Protection Act Compliance

We are in compliance with the requirements of COPPA (Childrens Online Privacy Protection Act), we do not collect any information from anyone under 13 years of age. Our website, products and services are all directed to people who are at least 13 years old or older.

Updating your personal information

We offer a ‘My details’ page (also known as Dashboard), where you can update your personal information at any time, and change your marketing preferences. You can get to this page from most pages on the site – simply click on the ‘My details’ link at the top of the screen when you are signed in.

Online Privacy Policy Only

This online privacy policy applies only to information collected through our website and not to information collected offline.

Your Consent

By using our site, you consent to our privacy policy.

Changes to our Privacy Policy

If we decide to change our privacy policy, we will post those changes on this page.
Save settings
Cookies settings