Questions tagged [gdpr]

For questions regarding the implementation of and impacts on design and operations in light of the EU General Data Protection Regulation.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

Deeplinks in email that autologin

I was wandering if, a deeplink inside an email that auto-authentication even though the session is expired, it is GDPR compliant. For instance if I send to an user an email subscription with links to ...
0
votes
1answer
110 views

Email under GDPR [closed]

I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
2
votes
1answer
134 views

Cryptographic requirements for GDPR

I'm looking into how to store emails and data regarding GDPR. The reasoning is that it would be beneficial to store users emails linked to certain data (shop data about purchases and questionnaires). ...
0
votes
2answers
57 views

Encrypted folder with different access rights for different users

With the GDPR (General Data Protection Regulation of EU) comes the necessity for many companies to store certain personal data (CVs, certificates, passport copies, etc.) centrally and encrypted. The ...
0
votes
3answers
116 views

Google Drive and GDPR [closed]

I can't seem to find much information on this online, and forgive me if this is obvious to other folks in the info-sec community but would storing documents such as CVs of applicants, letters written ...
1
vote
1answer
60 views

Is a company decrypting all SSL traffic through a Root CA GDPR compliant? [closed]

I am wondering if a company employing EU citizens is allowed to decrypt SSL traffic of those citizens in a MITM style attack without even informing them what data is collected (without even notifying ...
2
votes
1answer
63 views

Receiving Junk Email that is related to Skype conversations

My Microsoft email address and account are linked to Skype, OneDrive and Windows 10 (products I use by Microsoft). This account is not linked to my phone (Android). I don't use this account for Email (...
0
votes
0answers
78 views

What is Amazon's GDPR role with Alexa for Business Conferencing?

With respect to GDPR and the Alexa for Business conferencing solution, is Amazon acting in the capacity of a data controller or a data processor, or even a sub-processor? Here's some information on ...
0
votes
1answer
46 views

does mailto require opt-out when user sending initial request for information from website? [closed]

Everything I have been reading on mailto: requirements has been that the company sending the email or using a website form submitting information. My situation is: on the company website, a lot of ...
0
votes
1answer
54 views

GDPR data minimisation session cookies

I have a research study being run. Participants are asked to; Fill out a consent form (contains personal information as per GDPR) Complete a questionnaire. My hopes was that the questionnaire ...
28
votes
4answers
10k views

Is displaying email addresses in an application log file allowed under GDPR?

I'm working on an application that is completely built upon user interaction. In my application logs, I log each interaction and print the email address to uniquely identify which user did which ...
22
votes
2answers
6k views

Hashing email addresses for GDPR compliance

UPDATED We have a very unique scenario: We have several old databases of user accounts. We'd like a new system to be able to connect these old accounts to new accounts on the new system, if the user ...
1
vote
1answer
293 views

Steps to make website GDPR Compliant

I am working for a high traffic website developed in codeigniter. Can someone please help how to start working to make website GDPR compliant? Till now, I was able to identify the potential cookies ...
0
votes
2answers
198 views

GDPR - Personal Data breaches for invoices

A short question and scenario. Company X receives by mistake invoice of Company Y ( there is no relation between them ). Company X is reporting the case to Controller : - invoice is not mine , ...
1
vote
6answers
1k views

I am receiving weird emails regarding GDPR from electronicprivacy.eu

Since a week, I am getting some French emails. Since I don't know French I used google translate to know what is this about: Email 1: Bonjour, En application de mon droits d’accès et d’...
0
votes
2answers
197 views

Do websites outside of the EU need to consider GDPR? [closed]

There are a lot of items in the GDPR that I am a fan of. Mandatory unsubscribe links are the best thing to happen to my inbox since I started using email. But there is one thing in particular I've ...
1
vote
0answers
42 views

Method or tool to securely exchange sensitive data [closed]

Does anyone of you know tools or services that can help to securely exchange (personal or sensitive) data between two parties? After some requirements analysis, the tool or service should (among ...
1
vote
0answers
35 views

Do S3/Azure/GCS bucket names/keys represent personally identifiable information

We have an event-sourced system that uses a forward-only immutable event store. If we store personally identifiable information in this store, we'll be in trouble with regards to GDPR, as deletion ...
0
votes
2answers
84 views

Does the advent of GDPR result in improved protections for customers based exclusively in non-EU countries?

Sorry if the title is a bit confusing. I'll try to rephrase: GDPR obviously improves transparency and protective services in global service providers/vendors that involve users in the EU. I can see ...
1
vote
0answers
108 views

Do I need to remove all past customers email adresses from newsletter subscription, if I haven't asked them consent before May 25 (GDPR)? [closed]

I receive many emails those days: If you haven't given your consent before 2018 May 25 to stay subscribed to our newsletter, we will be forced to remove your email from subscription, in accordance ...
100
votes
7answers
21k views

Why do some GDPR emails require me to opt-out and some to opt-in? [closed]

I've noticed a trend in emails I've recieved as a result of GDPR, some of them are sort of 'opt-out' (or pseudo-opt-out where you just need to stop using their service) like so: Our updated Privacy ...
0
votes
1answer
89 views

Tokenization - Is it bad practice to reuse tokens?

If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens? For example, if I am storing the name "Richard" multiple times, and ...
19
votes
2answers
9k views

Is gender considered PII (Personally Identifiable Information) under the GDPR?

Since GDPR is shaking everything up at the minute I'm working on a few changes to our website/process. I work in eCommerce in UX (UK based) and support marketing teams with certain activities. My ...
1
vote
1answer
405 views

Microsoft Exchange: Email and attachment encrypting

As per recent updates in UK data protection legislation I have been trying to find ways of encrypting all outbound emails from my server and was considering moving all our emails from a basic email ...
-1
votes
1answer
342 views

What does pseudonymization mean in the context of web development?

In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development. The info I've read infers that it is ...
1
vote
0answers
219 views

GDPR compliance in Amazon AWS

Anybody has a nice checklist/todo list to achieve GDPR compliance in Amazon AWS environments? Want to use dev-sec.io checklists, OWASP for web app, AWS Trusted Advisor. Anything else to include/...
2
votes
1answer
1k views

EU GDPR - Data protection requirement standards missing?

I'm reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like Mimimum password length requirements Second factor authentication Backup ...
0
votes
1answer
119 views

GDPR data portability [closed]

I know one of the requirements of the GDPR is for data portability requests. On a website I have, it has users that includes their address, contact number etc but it also tracks what the user ...
12
votes
3answers
4k views

How to handle emails as usernames under GDPR?

Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
3
votes
1answer
146 views

Does GDPR apply to generic service providers?

Let's say you have a general Cloud service to create PDFs from content or even a data storage. Neither services are meant to process PII data (in the sense of GDPR), still - as the content is not ...
10
votes
1answer
588 views

GDPR Deletion Request Tracking Paradox - Suppression Lists

I work at a large-ish tech company with hundreds of websites and some large web applications with a very large number of users. I am planning to propose that we have a central system to track ...
6
votes
3answers
335 views

If I'm PCI-DSS compliant, do I need to worry about GDPR?

Next month, the EU's General Data Protection Regulation (GDPR) takes effect. Our organization is already PCI-DSS compliant. Do we need to do anything additional to make sure we are consistent with ...
4
votes
1answer
2k views

Does it make sense to encrypt database to comply with GDPR?

I had a hard time phrasing the question. I'd rather ask, "How do I comply with GDPR?" But that would probably be too broad of a question. Database encryption concerns me the most, since that's what ...
0
votes
0answers
92 views

Tracking user's private link on google analytics: will it be a security issue for GDPR?

Our web portal track page access with google analytics. The access link will be then tracked and exposed in google analytics reports. As the portal include personally identifiable information (PII), ...
2
votes
1answer
689 views

Caching personal data: GDPR

There are requests in my web application that contain "personal data" (name, postal code, phone number, date of birth etc). I would like to know what caching controls are advisable. I am using HTTPS. ...
3
votes
2answers
125 views

Should passwords and challenge questions & answers be migrated?

I am currently working on the migration of a user Identity and Access Management tool from a legacy platform (product + solution) to a new one (same product but upgraded + updated solution) My team ...
1
vote
2answers
1k views

What will the effect of the GDPR be on password dumps? [closed]

The GDPR changes a lot of data protection law, but how will it affect dumped databases of passwords? At the moment these can be used to work out the most common passwords, and sites can use this ...
0
votes
1answer
250 views

Under GDPR, is one user borrowing another's logged-in session for financial transactions illegal?

Our organization has historically been very lax with Data Protection and compliance, and we have a number of POS sales positions serving the public and taking payments; both Cash, Chip and Pin and ...