Skip to main content
Information Security

Return to Answer

Commonmark migration
Source Link
Community Bot
Community Bot
  • 1

The GDPR isn't just about storing sensitive data, but it's more general. In fact, it's actually about processing personal data. Here are a few interesting quotes from the GDPR that you might want to consider (emphasis added):

Article 2(1) - This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

 

Recital 15 - In order to prevent creating a serious risk of circumvention, the protection of natural persons should be technologically neutral and should not depend on the techniques used.

 

Article 4(6) - ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

 

Article 32(1) - Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: [...]

 

Article 32(3) - Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.

 

Article 40(2) - Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation, such as with regard to: [...] the measures to ensure security of processing referred to in Article 32;

 

Article 42(1) - The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors. [...]

To sum up, if you process personal data in an organized way, the GDPR applies to it. An array of strings containing personal data stored in volatile RAM could be considered a "filing system", for example. The GDPR doesn't tell you any details about the security controls you should implement. However it does tell you that it all depends on the level of security appropriate to the risk, and it also tells you that you there might be certification bodies or specific codes of conduct for certain fields that will help you demonstrate compliance. In other words, if you are processing email addresses for the purpose of managing a simple student's blog, your security requirements will definitely be very simple. On the other hand, if you run a business that deals with health data, chances are you need to consult a lawyer (or more than one), and think about getting some ISO certifications for example.

The GDPR isn't just about storing sensitive data, but it's more general. In fact, it's actually about processing personal data. Here are a few interesting quotes from the GDPR that you might want to consider (emphasis added):

Article 2(1) - This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

 

Recital 15 - In order to prevent creating a serious risk of circumvention, the protection of natural persons should be technologically neutral and should not depend on the techniques used.

 

Article 4(6) - ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

 

Article 32(1) - Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: [...]

 

Article 32(3) - Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.

 

Article 40(2) - Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation, such as with regard to: [...] the measures to ensure security of processing referred to in Article 32;

 

Article 42(1) - The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors. [...]

To sum up, if you process personal data in an organized way, the GDPR applies to it. An array of strings containing personal data stored in volatile RAM could be considered a "filing system", for example. The GDPR doesn't tell you any details about the security controls you should implement. However it does tell you that it all depends on the level of security appropriate to the risk, and it also tells you that you there might be certification bodies or specific codes of conduct for certain fields that will help you demonstrate compliance. In other words, if you are processing email addresses for the purpose of managing a simple student's blog, your security requirements will definitely be very simple. On the other hand, if you run a business that deals with health data, chances are you need to consult a lawyer (or more than one), and think about getting some ISO certifications for example.

The GDPR isn't just about storing sensitive data, but it's more general. In fact, it's actually about processing personal data. Here are a few interesting quotes from the GDPR that you might want to consider (emphasis added):

Article 2(1) - This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

Recital 15 - In order to prevent creating a serious risk of circumvention, the protection of natural persons should be technologically neutral and should not depend on the techniques used.

Article 4(6) - ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

Article 32(1) - Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: [...]

Article 32(3) - Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.

Article 40(2) - Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation, such as with regard to: [...] the measures to ensure security of processing referred to in Article 32;

Article 42(1) - The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors. [...]

To sum up, if you process personal data in an organized way, the GDPR applies to it. An array of strings containing personal data stored in volatile RAM could be considered a "filing system", for example. The GDPR doesn't tell you any details about the security controls you should implement. However it does tell you that it all depends on the level of security appropriate to the risk, and it also tells you that you there might be certification bodies or specific codes of conduct for certain fields that will help you demonstrate compliance. In other words, if you are processing email addresses for the purpose of managing a simple student's blog, your security requirements will definitely be very simple. On the other hand, if you run a business that deals with health data, chances are you need to consult a lawyer (or more than one), and think about getting some ISO certifications for example.

Source Link
reed
reed
  • 15.9k
  • 6
  • 50
  • 73

The GDPR isn't just about storing sensitive data, but it's more general. In fact, it's actually about processing personal data. Here are a few interesting quotes from the GDPR that you might want to consider (emphasis added):

Article 2(1) - This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

Recital 15 - In order to prevent creating a serious risk of circumvention, the protection of natural persons should be technologically neutral and should not depend on the techniques used.

Article 4(6) - ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

Article 32(1) - Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: [...]

Article 32(3) - Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.

Article 40(2) - Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation, such as with regard to: [...] the measures to ensure security of processing referred to in Article 32;

Article 42(1) - The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors. [...]

To sum up, if you process personal data in an organized way, the GDPR applies to it. An array of strings containing personal data stored in volatile RAM could be considered a "filing system", for example. The GDPR doesn't tell you any details about the security controls you should implement. However it does tell you that it all depends on the level of security appropriate to the risk, and it also tells you that you there might be certification bodies or specific codes of conduct for certain fields that will help you demonstrate compliance. In other words, if you are processing email addresses for the purpose of managing a simple student's blog, your security requirements will definitely be very simple. On the other hand, if you run a business that deals with health data, chances are you need to consult a lawyer (or more than one), and think about getting some ISO certifications for example.