GDPR Compliance Journey - 13 Technical Measures

Summary

In this GDPR compliance video, Mike Savin discusses the importance of implementing appropriate technical measures to protect personal data. He highlights the need to assess the level of sensitivity of the data and the associated risks, suggesting Cyber Essentials as a base level standard for UK organizations. Savin also offers practical advice for non-technical individuals on securing personal information, emphasizing the importance of documentation and ongoing review of these measures.

Takeaways

• 🔒 GDPR requires the implementation of appropriate technical measures to protect personal data, but it does not specify which measures to use.
• 📏 The level of technical measures should be commensurate with the sensitivity of the personal information and the associated risks.
• 👶 For highly sensitive data, such as information about children, a higher level of technical control is recommended.
• 💡 Cyber Essentials is suggested as a good starting point for implementing technical measures, providing a base level of IT security.
• 🇬🇧 The UK government recommends Cyber Essentials for organizations wanting to work with them, indicating its importance.
• 🔄 Cyber Essentials covers a broad range of topics including infrastructure scope, firewalls, device configuration, user access, malware protection, and system updates.
• 🆓 Access to Cyber Essentials is available for free through the Guidelines software, making it accessible to all organizations.
• 👷 For those not technically minded, simple steps like using strong passwords, changing default passwords, and enabling two-factor authentication can enhance security.
• 📊 Data mapping and Data Protection Impact Assessments (DPIAs) are crucial for identifying necessary technical measures and assessing their effectiveness.
• 📝 Documentation of implemented technical measures is essential for ongoing review and testing of security measures.
• 🔄 Regular review and testing of technical measures ensure ongoing compliance and security.

Q & A

What is the main topic discussed in the video script?

The main topic discussed in the video script is the implementation of technical measures as part of GDPR compliance, with a focus on the Cyber Essentials scheme as a base level standard for organizations.

What does GDPR require in terms of technical measures?

GDPR requires organizations to implement appropriate technical measures such as data encryption or pseudonymization, which should be commensurate with the level of personal information and the associated risks.

What is Cyber Essentials and why is it recommended by the UK government?

Cyber Essentials is a scheme that lays out a base level of simple IT security measures that the UK government recommends all organizations should follow. It is designed to help protect against common cyber threats and is considered a good starting point for technical measures.

What are some of the basic topic areas covered by the Cyber Essentials scheme?

The Cyber Essentials scheme covers areas such as the scope of technical infrastructure, firewalls, device configuration, user access control, malware protection, and the importance of keeping systems updated.

How can non-technical individuals ensure they are being careful with personal information?

Non-technical individuals can ensure careful handling of personal information by using long and strong passwords, changing default passwords on new devices, implementing two-factor authentication, and being mindful of what they send and do.

What is the significance of data mapping in the context of GDPR compliance?

Data mapping is significant as it helps identify processes that may present more risk, guiding the organization to perform a data protection impact assessment and determine the necessary technical measures to be implemented.

Why is it important to document the technical measures implemented?

Documenting technical measures is important because it allows organizations to review and test these measures on an ongoing basis, ensuring continuous compliance and the ability to demonstrate compliance if challenged.

How can organizations access the Cyber Essentials guidelines and what does it cost?

Organizations can access the Cyber Essentials guidelines for free by signing up on the guidelines software platform, which is available to everyone at no cost.

What is the next step after implementing technical measures according to the video script?

The next step after implementing technical measures is to review and test these measures regularly, which will be discussed in a later video.

What is the role of a data protection impact assessment in determining technical measures?

A data protection impact assessment helps detail which measures have been put in place and is crucial for identifying the necessary technical measures based on the risks associated with specific data processing activities.

What are some practical steps for organizations to enhance their technical security?

Practical steps include implementing strong password policies, using secure mobile phone codes for two-factor authentication, and considering password-protecting spreadsheets that contain personal information.