Questions tagged [eu-data-protection]

The Data Protection Directive is a European Union directive which regulates the processing of personal data within the European Union. It is an important component of EU privacy and human rights law.

Filter by
Sorted by
Tagged with
0 votes
0 answers

Standards for data availability for internal employees [migrated]

Our organization possesses a lot of personal data, and when we provide the data to external partners we are very strict on complying with all the data confidentiality rules, recommendations, etc. The ...
ZygD's user avatar
  • 267
0 votes
0 answers

EU GDPR: Can someone store the data inside EU but process them in US [duplicate]

I'm a bit lost in here and need some direction. According to the EU GDPR, the PII data should never leave the EU. But, Can they be taken out and processed outside? such as in a server that is situated ...
Saikat Chakrabortty's user avatar
3 votes
2 answers

How can I protect data in SQL tables?

Inspired by the many data leaks where whole databases/tables with personal user information were leaked, what are best practices to protect those assets? I‘m especially concerned if someone was able ...
dmuensterer's user avatar
  • 1,184
3 votes
3 answers

Does GDPR apply for volatile data

GDPR aims to set standards (and requirements) on how sensitive data should be stored. Although, I couldn't find any information on how (or if even) GDPR applies for sensitive data in a volatile state. ...
dben's user avatar
  • 133
4 votes
3 answers

Security problem with confirmation email

I have an app, and when they first login, I send a classic confirmation email. When users need to reinstall the app, sometimes users send messages to our support saying: "I don't remember the email ...
JungleFever's user avatar
1 vote
0 answers

Billing Information and Right to be Forgotten under GDPR [closed]

This question is from a SAAS point-of-view. If a user exercises their Right to be Forgotten under GDPR, what happens to their billing information? Good practice suggests you should delete card info ...
shivam's user avatar
  • 119
2 votes
1 answer

Does an email newsletter form on a HTTP-only website constitute a GDPR violation? [closed]

Problem: I am part of a non-profit club that has a form on the website for signing up for an email newsletter. The website (and thus form) is only available through through HTTP. HTTPS is not ...
max's user avatar
  • 121
1 vote
1 answer

Storing e-mails on private servers and getting consent from data subjects (EU GDPR)

My initial reading of the GDPR doesn't seem to cover cases of consent with regards to inbound e-mails. If I run a corporate e-mail server and store all incoming e-mails on it, I'm storing private data ...
Jochen Bedersdorfer's user avatar
2 votes
1 answer

Should we confirm other personal details before security questions during password resets?

I've been tasked to work on a password reset tool for my company website. This tool is for a support person to provide a new reset password over the phone in case the customer does not receive the ...
Sparkz's user avatar
  • 21
1 vote
0 answers

certification to get in order to save PHI for European businesses

I work in a digital health company that will likely save personal Health information. I am conflicting what certification I best get in order to best meet the needs of business partners from Europe. ...
WebQube's user avatar
  • 129
1 vote
1 answer

sensitive assets identified and properly protected

I am going through the IASME cyber essentials questionnaire and one of the questions is are all sensitive assets identified (eg protective marking) and properly protected? I have googled ...
Anonymous5642's user avatar
1 vote
1 answer

Icons/Symbols according to GDPR

According to Article 12(7) of the European General Data Protection Regulation 2016/679 there shall be standard icons for making data collection more transparent for data subjects (end users): ...
eckes's user avatar
  • 982
1 vote
2 answers

Technical requirements applicable to IT department for GDPR [closed]

In order to prepare for GDPR, what is required from an IT department to ensure Data protection for the business.
Avinash Kaur Babra's user avatar
1 vote
4 answers

HTTPS packets filtering

I would like to know whether a firewall can scan an HTTPS packet, to verify its source, destination, and data. Or how to stop a user from sending the file over HTTPS if it contains some unwanted ...
Omkar Patil's user avatar
2 votes
1 answer

Can a user login credentials and/or secret questions be considered PII under EU regulations?

European Union is one of the most regulated places on how to deal with Personally Identifiable Information. I was going to answer this question by saying that he had to hash the user password because ...
Mindwin Remember Monica's user avatar
2 votes
1 answer

Under UK data protection act, who is reponsible for ensuring the data is transmitted to the data processor securely

Preamble: I'm being reference-checked by a company. This company has asked me to send them my personal details (like NI numbers) via email (unsecured; unencrypted: big no-no). (To avoid side-tracking ...
KidneyChris's user avatar
5 votes
2 answers

Should I email contents of a https form submission

I am building an online registration form for a voluntary organisation in the UK and am considering data security measures. The form will be served up over https and there may be an optional payment ...
brianilland's user avatar
4 votes
1 answer

New EU Data protection Law and small businesses

I'm aware of the new EU law changes regarding data protection. As a security consultant for an IT company who manages multiple other companies systems, i was hoping someone might be able to clarify a ...
IngenuIT's user avatar