Questions tagged [eu-data-protection]
The Data Protection Directive is a European Union directive which regulates the processing of personal data within the European Union. It is an important component of EU privacy and human rights law.
17 questions
0
votes
0
answers
54
views
EU GDPR: Can someone store the data inside EU but process them in US [duplicate]
I'm a bit lost in here and need some direction.
According to the EU GDPR, the PII data should never leave the EU.
But, Can they be taken out and processed outside? such as in a server that is situated ...
3
votes
2
answers
919
views
How can I protect data in SQL tables?
Inspired by the many data leaks where whole databases/tables with personal user information were leaked, what are best practices to protect those assets?
I‘m especially concerned if someone was able ...
- 1,194
3
votes
3
answers
1k
views
Does GDPR apply for volatile data
GDPR aims to set standards (and requirements) on how sensitive data should be stored. Although, I couldn't find any information on how (or if even) GDPR applies for sensitive data in a volatile state. ...
- 133
4
votes
3
answers
249
views
Security problem with confirmation email
I have an app, and when they first login, I send a classic confirmation email. When users need to reinstall the app, sometimes users send messages to our support saying: "I don't remember the email ...
- 41
1
vote
0
answers
1k
views
Billing Information and Right to be Forgotten under GDPR [closed]
This question is from a SAAS point-of-view. If a user exercises their Right to be Forgotten under GDPR, what happens to their billing information?
Good practice suggests you should delete card info ...
- 119
2
votes
1
answer
223
views
Does an email newsletter form on a HTTP-only website constitute a GDPR violation? [closed]
Problem:
I am part of a non-profit club that has a form on the website for signing up for an email newsletter.
The website (and thus form) is only available through through HTTP. HTTPS is not ...
- 121
1
vote
1
answer
241
views
Storing e-mails on private servers and getting consent from data subjects (EU GDPR)
My initial reading of the GDPR doesn't seem to cover cases of consent with regards to inbound e-mails.
If I run a corporate e-mail server and store all incoming e-mails on it, I'm storing private data ...
2
votes
1
answer
145
views
Should we confirm other personal details before security questions during password resets?
I've been tasked to work on a password reset tool for my company website. This tool is for a support person to provide a new reset password over the phone in case the customer does not receive the ...
- 21
1
vote
0
answers
130
views
certification to get in order to save PHI for European businesses
I work in a digital health company that will likely save personal Health information.
I am conflicting what certification I best get in order to best meet the needs of business partners from Europe.
...
- 129
1
vote
1
answer
123
views
sensitive assets identified and properly protected
I am going through the IASME cyber essentials questionnaire and one of the questions is
are all sensitive assets identified (eg protective marking) and properly protected?
I have googled ...
1
vote
1
answer
2k
views
Icons/Symbols according to GDPR
According to Article 12(7) of the European General Data Protection Regulation 2016/679 there shall be standard icons for making data collection more transparent for data subjects (end users):
...
- 983
1
vote
2
answers
716
views
Technical requirements applicable to IT department for GDPR [closed]
In order to prepare for GDPR, what is required from an IT department to ensure Data protection for the business.
1
vote
4
answers
844
views
HTTPS packets filtering
I would like to know whether a firewall can scan an HTTPS packet, to verify its source, destination, and data.
Or how to stop a user from sending the file over HTTPS if it contains some unwanted ...
- 11
2
votes
1
answer
3k
views
Can a user login credentials and/or secret questions be considered PII under EU regulations?
European Union is one of the most regulated places on how to deal with Personally Identifiable Information.
I was going to answer this question by saying that he had to hash the user password because ...
- 1,138
2
votes
1
answer
161
views
Under UK data protection act, who is reponsible for ensuring the data is transmitted to the data processor securely
Preamble: I'm being reference-checked by a company. This company has asked me to send them my personal details (like NI numbers) via email (unsecured; unencrypted: big no-no). (To avoid side-tracking ...
- 695
5
votes
2
answers
195
views
Should I email contents of a https form submission
I am building an online registration form for a voluntary organisation in the UK and am considering data security measures.
The form will be served up over https and there may be an optional payment ...
- 53
4
votes
1
answer
263
views
New EU Data protection Law and small businesses
I'm aware of the new EU law changes regarding data protection. As a security consultant for an IT company who manages multiple other companies systems, i was hoping someone might be able to clarify a ...
- 43