Questions tagged [gdpr]

For questions regarding the implementation of and impacts on design and operations in light of the EU General Data Protection Regulation.

Filter by
Sorted by
Tagged with
0 votes
0 answers
19 views

Is there a cryptographic solution to the GDPR SAR ID check problem? [migrated]

There are two bits of apparently contradictory advice on the internet. The first is somewhat harder to find because it seems so obvious: Don't give out your personal information unless you first ...
User65535's user avatar
  • 151
0 votes
1 answer
63 views

Saas software, cloud services and ISO assets

I'm putting a list of assets together, but I'm really struggling to figure out how to categorise them. Take for example you have the following: MailChimp (Full SaaS, holds potential PII in a database ...
Trent's user avatar
  • 143
1 vote
0 answers
135 views

I have found my email online in a .txt file. What should be my next steps? [closed]

A few days ago someone tried to log into my bank account, the attempt was unsuccessful but it was quite concerning. I’ve spent the past weekend moving my most important accounts to alternate emails ...
Ahania's user avatar
  • 11
3 votes
1 answer
272 views

How does Google Cloud Customer Managed Encryption Keys (CMEK) differ from normal at-rest encryption

I am trying to solve a compliance issue with a vendor that uses Google Cloud with Customer Managed Encryption Keys (CMEK). The vendor stores personal data in Google Cloud and claims that CMEK makes ...
oilyhiccup's user avatar
0 votes
1 answer
76 views

Questions on user context and auditing for background job execution for SaaS application

I have some questions related with user context and auditing for background job execution for SaaS application. Let's say an admin user scheduled a background job through UI. When the job start ...
user1024888's user avatar
1 vote
0 answers
147 views

How do I make sure the information I collect on a person does not constitute personal data/PII?

I'm building an application that may involve the storage of certain information pertaining to potentially millions users of a popular social media platform for analytics purposes, making the obtaining ...
moonman239's user avatar
1 vote
1 answer
302 views

Choosing the right salt to pseudo-anonymize data and be GDPR compliant

In my company, numeric user IDs are considered PIIs and therefore need to be pseudo-anonymized to be GDPR compliant. To do so, we populate a lookup table where to each ID is assigned a monotonically ...
Vektor88's user avatar
  • 111
0 votes
4 answers
321 views

How to protect email addresses in a customer database when you and other third parties must be able to send emails?

I am wondering what methods are used by big companies to protect customer email addresses in their databases. They usually have salespeople all over the world and multiple third-parties (Salesforce, ...
C.Card21's user avatar
1 vote
0 answers
122 views

How do we reconcile a requirement to keep backups, with a requirement that we be able to purge data on request? [closed]

As part of SOC 2 preparation (and just general operational best-practice) we take regular PostgreSQL backups and keep them for up to a year. One of our partners has a requirement that we be able to ...
recurser's user avatar
1 vote
2 answers
125 views

publication of GDPR implementation

I'm aware of this post that GDPR apparently does not enforce a specific standard to secure sensible data. Based on this post e.g., there is no requirement to encrypt or hash login data in a local ...
Buttonwood's user avatar
0 votes
1 answer
284 views

Sending and blocking emails from hashed and salted address ? (for GDPR)

I would like to send emails from a server, but also make them unable to trace for me as server owner or attackers. I want this for GDPR but also to protect people from abusers. Short info about ...
user avatar
0 votes
0 answers
52 views

EU GDPR: Can someone store the data inside EU but process them in US [duplicate]

I'm a bit lost in here and need some direction. According to the EU GDPR, the PII data should never leave the EU. But, Can they be taken out and processed outside? such as in a server that is situated ...
Saikat Chakrabortty's user avatar
1 vote
2 answers
2k views

What personal data should be encrypted in a database?

I am having trouble answering what seems like a simple question. I was hoping to find a Yep/Nope style list somewhere, but can't seem to find one. What data should be encrypted in a cloud (e.g. AWS/...
JsAndDotNet's user avatar
1 vote
0 answers
602 views

How have you secured production data (PII) on non-prod environments?

Data protection laws including GDPR state: “Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that ...
Architect 's user avatar
3 votes
3 answers
1k views

Does GDPR apply for volatile data

GDPR aims to set standards (and requirements) on how sensitive data should be stored. Although, I couldn't find any information on how (or if even) GDPR applies for sensitive data in a volatile state. ...
dben's user avatar
  • 133
0 votes
1 answer
246 views

GDPR data flow mapping and inventory

Anybody can share some tips on how to create a nice GDPR data flow mapping and inventory? Any sample diagrams? What diagrams types are best to be used here? Would you show high level diagram and sub-...
dev's user avatar
  • 997
0 votes
1 answer
190 views

Is it a possible vulnerability / GDPR violation if basic profile of users are enumerable through the URL?

If a website uses an auto-incrementing user-id in its url – /users/1, /users/2 to showcase public user profiles (just the name + photo / avatar) is it considered a possible vulnerability?
Shubham Kanodia's user avatar
0 votes
0 answers
28 views

How to approach a site that doesn't manage passwords correctly? [duplicate]

I am registered to a site which doesn't manage password correctly. It is a user area for a company that provides services of some sort and which uses the area to show details of the contracts and for ...
bracco23's user avatar
  • 123
3 votes
1 answer
184 views

Putting personal Data in E-Mail vs sending password in plaintext to access that data

I started working on a service that sends out mails with a link to a registration form. (e.g. a registration for a movie premier) The link would look like this https://movie-premier.com/rsvp/USERCODE ...
confused's user avatar
1 vote
1 answer
1k views

Active Directory GDPR classification

GDPR classifies data into Non-personal, Personal and Sensitive personal. Sensitive personal is further broken down to Genetic and biometric, Racial and ethnical, Religion and Philosophical etc. ...
aquaman's user avatar
  • 93
0 votes
1 answer
199 views

Firefox Account - Export user data (GDPR)

Is there a way of exporting all user data associated with a Firefox Account? Yes? where can I request/download it? No? isn't right of access a legal requirement under the current GDPR ...
Pedro Lobito's user avatar
1 vote
1 answer
124 views

Is it ok to assume a user has opted-in to receive emails in an application where the main purpose is sending notifications [closed]

I'm working on a web application where the main purpose/functionality is notifying users when there have been changes to regulations in a particular industry. The application is subscription based, i....
Andy's user avatar
  • 320
3 votes
3 answers
2k views

Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?

Under GDPR, IP addresses are personal data. I have no need to trace back IP to specific users, but I would like to limit downloads to one per IP.* I do not want to store plain IPs. My first solution ...
Karel's user avatar
  • 133
6 votes
2 answers
4k views

Documentation for GDPR best practices for partially masking email addresses

I must give certain employees access to a report which contains email addresses. I would like to redact or partially mask these email addresses, but I am having trouble finding official guidance on ...
MeMyselfI's user avatar
  • 163
1 vote
1 answer
374 views

Deeplinks in email that autologin

I'm wondering if a deep link in an e-mail that automatically authenticate even though the session is expired is GDPR compliant. For instance if I send an e-mail to a user with links to the internal ...
Tizz's user avatar
  • 11
1 vote
1 answer
316 views

Email under GDPR [closed]

I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
user211383's user avatar
4 votes
1 answer
547 views

Cryptographic requirements for GDPR

I'm looking into how to store emails and data regarding GDPR. The reasoning is that it would be beneficial to store users emails linked to certain data (shop data about purchases and questionnaires). ...
user210772's user avatar
0 votes
2 answers
138 views

Encrypted folder with different access rights for different users

With the GDPR (General Data Protection Regulation of EU) comes the necessity for many companies to store certain personal data (CVs, certificates, passport copies, etc.) centrally and encrypted. The ...
gebrerv's user avatar
2 votes
3 answers
2k views

Google Drive and GDPR [closed]

I can't seem to find much information on this online, and forgive me if this is obvious to other folks in the info-sec community but would storing documents such as CVs of applicants, letters written ...
Anon's user avatar
  • 21
1 vote
1 answer
1k views

Is a company decrypting all SSL traffic through a Root CA GDPR compliant? [closed]

I am wondering if a company employing EU citizens is allowed to decrypt SSL traffic of those citizens in a MITM style attack without even informing them what data is collected (without even notifying ...
anonymous employee's user avatar
2 votes
1 answer
210 views

Receiving Junk Email that is related to Skype conversations

My Microsoft email address and account are linked to Skype, OneDrive and Windows 10 (products I use by Microsoft). This account is not linked to my phone (Android). I don't use this account for Email (...
Nuno's user avatar
  • 215
0 votes
1 answer
236 views

does mailto require opt-out when user sending initial request for information from website? [closed]

Everything I have been reading on mailto: requirements has been that the company sending the email or using a website form submitting information. My situation is: on the company website, a lot of ...
barbaraG's user avatar
0 votes
1 answer
160 views

GDPR data minimisation session cookies

I have a research study being run. Participants are asked to; Fill out a consent form (contains personal information as per GDPR) Complete a questionnaire. My hopes was that the questionnaire ...
Fionn Delahunty's user avatar
35 votes
4 answers
19k views

Is displaying email addresses in an application log file allowed under GDPR?

I'm working on an application that is completely built upon user interaction. In my application logs, I log each interaction and print the email address to uniquely identify which user did which ...
Titulum's user avatar
  • 453
24 votes
3 answers
15k views

Hashing email addresses for GDPR compliance

UPDATED We have a very unique scenario: We have several old databases of user accounts. We'd like a new system to be able to connect these old accounts to new accounts on the new system, if the user ...
Django Reinhardt's user avatar
2 votes
1 answer
2k views

Steps to make website GDPR Compliant

I am working for a high traffic website developed in codeigniter. Can someone please help how to start working to make website GDPR compliant? Till now, I was able to identify the potential cookies ...
Arun Jain's user avatar
  • 153
1 vote
2 answers
3k views

GDPR - Personal Data breaches for invoices

A short question and scenario. Company X receives by mistake invoice of Company Y ( there is no relation between them ). Company X is reporting the case to Controller : - invoice is not mine , ...
GDPR_noob's user avatar
1 vote
6 answers
2k views

I am receiving weird emails regarding GDPR from electronicprivacy.eu

Since a week, I am getting some French emails. Since I don't know French I used google translate to know what is this about: Email 1: Bonjour, En application de mon droits d’accès et d’...
undefinedman's user avatar
0 votes
2 answers
272 views

Do websites outside of the EU need to consider GDPR? [closed]

There are a lot of items in the GDPR that I am a fan of. Mandatory unsubscribe links are the best thing to happen to my inbox since I started using email. But there is one thing in particular I've ...
Shadow's user avatar
  • 211
1 vote
0 answers
130 views

Method or tool to securely exchange sensitive data [closed]

Does anyone of you know tools or services that can help to securely exchange (personal or sensitive) data between two parties? After some requirements analysis, the tool or service should (among ...
user3687056's user avatar
1 vote
0 answers
90 views

Do S3/Azure/GCS bucket names/keys represent personally identifiable information

We have an event-sourced system that uses a forward-only immutable event store. If we store personally identifiable information in this store, we'll be in trouble with regards to GDPR, as deletion ...
spender's user avatar
  • 121
0 votes
2 answers
137 views

Does the advent of GDPR result in improved protections for customers based exclusively in non-EU countries?

Sorry if the title is a bit confusing. I'll try to rephrase: GDPR obviously improves transparency and protective services in global service providers/vendors that involve users in the EU. I can see ...
Mike B's user avatar
  • 3,458
1 vote
0 answers
167 views

Do I need to remove all past customers email adresses from newsletter subscription, if I haven't asked them consent before May 25 (GDPR)? [closed]

I receive many emails those days: If you haven't given your consent before 2018 May 25 to stay subscribed to our newsletter, we will be forced to remove your email from subscription, in accordance ...
Basj's user avatar
  • 963
98 votes
7 answers
22k views

Why do some GDPR emails require me to opt-out and some to opt-in? [closed]

I've noticed a trend in emails I've recieved as a result of GDPR, some of them are sort of 'opt-out' (or pseudo-opt-out where you just need to stop using their service) like so: Our updated Privacy ...
AncientSwordRage's user avatar
0 votes
1 answer
273 views

Tokenization - Is it bad practice to reuse tokens?

If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens? For example, if I am storing the name "Richard" multiple times, and ...
Marc's user avatar
  • 141
19 votes
2 answers
16k views

Is gender considered PII (Personally Identifiable Information) under the GDPR?

Since GDPR is shaking everything up at the minute I'm working on a few changes to our website/process. I work in eCommerce in UX (UK based) and support marketing teams with certain activities. My ...
sclarke's user avatar
  • 301
1 vote
1 answer
720 views

Microsoft Exchange: Email and attachment encrypting

As per recent updates in UK data protection legislation I have been trying to find ways of encrypting all outbound emails from my server and was considering moving all our emails from a basic email ...
Connor Simpson's user avatar
-1 votes
1 answer
612 views

What does pseudonymization mean in the context of web development?

In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development. The info I've read infers that it is ...
Marc's user avatar
  • 141
1 vote
0 answers
368 views

GDPR compliance in Amazon AWS

Anybody has a nice checklist/todo list to achieve GDPR compliance in Amazon AWS environments? Want to use dev-sec.io checklists, OWASP for web app, AWS Trusted Advisor. Anything else to include/...
dev's user avatar
  • 997
2 votes
1 answer
1k views

EU GDPR - Data protection requirement standards missing?

I'm reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like Mimimum password length requirements Second factor authentication Backup ...
Marcel's user avatar
  • 4,086