Questions tagged [eu-data-protection]

The Data Protection Directive is a European Union directive which regulates the processing of personal data within the European Union. It is an important component of EU privacy and human rights law.

Filter by
Sorted by
Tagged with
0
votes
0answers
47 views

EU GDPR: Can someone store the data inside EU but process them in US [duplicate]

I'm a bit lost in here and need some direction. According to the EU GDPR, the PII data should never leave the EU. But, Can they be taken out and processed outside? such as in a server that is situated ...
3
votes
2answers
149 views

How can I protect data in SQL tables?

Inspired by the many data leaks where whole databases/tables with personal user information were leaked, what are best practices to protect those assets? I‘m especially concerned if someone was able ...
3
votes
3answers
233 views

Does GDPR apply for volatile data

GDPR aims to set standards (and requirements) on how sensitive data should be stored. Although, I couldn't find any information on how (or if even) GDPR applies for sensitive data in a volatile state. ...
4
votes
3answers
163 views

Security problem with confirmation email

I have an app, and when they first login, I send a classic confirmation email. When users need to reinstall the app, sometimes users send messages to our support saying: "I don't remember the email ...
1
vote
0answers
1k views

Billing Information and Right to be Forgotten under GDPR [closed]

This question is from a SAAS point-of-view. If a user exercises their Right to be Forgotten under GDPR, what happens to their billing information? Good practice suggests you should delete card info ...
2
votes
1answer
155 views

Does an email newsletter form on a HTTP-only website constitute a GDPR violation? [closed]

Problem: I am part of a non-profit club that has a form on the website for signing up for an email newsletter. The website (and thus form) is only available through through HTTP. HTTPS is not ...
1
vote
1answer
164 views

Storing e-mails on private servers and getting consent from data subjects (EU GDPR)

My initial reading of the GDPR doesn't seem to cover cases of consent with regards to inbound e-mails. If I run a corporate e-mail server and store all incoming e-mails on it, I'm storing private data ...
2
votes
1answer
61 views

Should we confirm other personal details before security questions during password resets?

I've been tasked to work on a password reset tool for my company website. This tool is for a support person to provide a new reset password over the phone in case the customer does not receive the ...
1
vote
0answers
50 views

certification to get in order to save PHI for European businesses

I work in a digital health company that will likely save personal Health information. I am conflicting what certification I best get in order to best meet the needs of business partners from Europe. ...
1
vote
1answer
55 views

sensitive assets identified and properly protected

I am going through the IASME cyber essentials questionnaire and one of the questions is are all sensitive assets identified (eg protective marking) and properly protected? I have googled ...
1
vote
1answer
2k views

Icons/Symbols according to GDPR

According to Article 12(7) of the European General Data Protection Regulation 2016/679 there shall be standard icons for making data collection more transparent for data subjects (end users): ...
1
vote
2answers
623 views

Technical requirements applicable to IT department for GDPR [closed]

In order to prepare for GDPR, what is required from an IT department to ensure Data protection for the business.
1
vote
4answers
583 views

HTTPS packets filtering

I would like to know whether a firewall can scan an HTTPS packet, to verify its source, destination, and data. Or how to stop a user from sending the file over HTTPS if it contains some unwanted ...
2
votes
1answer
2k views

Can a user login credentials and/or secret questions be considered PII under EU regulations?

European Union is one of the most regulated places on how to deal with Personally Identifiable Information. I was going to answer this question by saying that he had to hash the user password because ...
2
votes
1answer
93 views

Under UK data protection act, who is reponsible for ensuring the data is transmitted to the data processor securely

Preamble: I'm being reference-checked by a company. This company has asked me to send them my personal details (like NI numbers) via email (unsecured; unencrypted: big no-no). (To avoid side-tracking ...
5
votes
2answers
111 views

Should I email contents of a https form submission

I am building an online registration form for a voluntary organisation in the UK and am considering data security measures. The form will be served up over https and there may be an optional payment ...
4
votes
1answer
189 views

New EU Data protection Law and small businesses

I'm aware of the new EU law changes regarding data protection. As a security consultant for an IT company who manages multiple other companies systems, i was hoping someone might be able to clarify a ...