5

The GDPR isn't just about storing sensitive data, but it's more general. In fact, it's actually about processing personal data. Here are a few interesting quotes from the GDPR that you might want to consider (emphasis added): Article 2(1) - This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing ...


4

I'd advice against sending all that information in an email. Mail-storage is probably not the problem, but SMTP is terribly insecure (not encrypted, usually easily MITMed even if there is TLS support available). If you are set on sending a confirmation mail, leave out sensitive information like the person's date of birth. IANAL (nor do I live in Britain), ...


3

The data protection law requires companies to protect personal information in a reasonable secure way. The fine is scalable as it depends on the company's annual turnover. It's a bit more 'fair' than on a per-employee basis (e.g. a 5 man company can have 100k but als a 5 million euro turnover). First of all note that this is not entirely new, so if you are ...


3

A password is not considered PII because it's not something that can be used to identify a person. By contrast, all the others you're listing can be used to do that. Also, notice there are different levels of PII. An email and phone number have a 1:1 relation with an identity, while a pair secret question-answer and a IP address might not be directly linked ...


3

I‘m especially concerned if someone was able to get access to backend code and therefore acquire the SQL credentials. The database system should be accessible from a limited number of systems. Specifically, it should not be accessible from the internet. If someone has the SQL credentials, they still won't have access to the server. Common sources of leaks ...


2

Although, I couldn't find any information on how (or if even) GDPR applies for sensitive data in a volatile state GDPR indicates to protect data in storage, processing and in transit. The data in the volatile memory is(in most cases)/shall only be accessible to trusted process/ child or parent process or processes. Basically make sure process can not be ...


2

Short answer: GDPR does not strictly require you to use encryption. Long answer: There are no guidelines on how to see encryption in the scope of the GDPR, which really is a pity given existing confusions. However, there are some guidelines mentioning encryption. But guidelines are not something mandatory. Although the GDPR obviously requires that ...


2

Reinstalling shouldn't need a verification code, if they have their name and password to login. Reinstall on fresh device, log in, there is your account. Password reset, on the other hand, implies they have lost/forgotten password, but still know their username. If their username was their email, then they know which email they've signed up with. So I have ...


2

You need to process personally identifiable information (PII) stored in e-mails so that you can run an e-mail server for your company. This means you have a legitimate interest in processing PII and as long as you don't use the the collected personal information for any other reason than e-mail communication, you do not have to obtain an explicit consent. ...


2

Personally I thought this would be an additional step from a data protection point of view and an added level of security. This is correct. The disagreement I had was with the other members of my team who thought this amendment was completely unnecessary. This might also be correct. The more information you can get from the user, the more confidence ...


2

There are two aspects to prevent data loss of the type you are concerned about. Deep Packet Inspection For HTTPS which is, of course, encrypted between the source and destination, you need a security service that has, as Mark said, a certificate trusted by your users browsers. It acts as a Man-in-The-Middle and so is able to continue to inspect all of the ...


2

You can offer the user a download of that PDF from the site, perhaps, on the next page after they've submitted the form. That way, it will only be transmitted by the same (HTTPS) channel used to send the same data in. Edit - sorry I see there is already an answer saying the same thing :)


1

Please let me start by saying that I am an IT person not a lawyer. As such, this is my opinion on the matter and cannot be taken as definitive. As in the comments, the Data Controller is responsible for the data over all. The DC may pass data to others to process and Data Processors have their own responsibilities but the Data Controller cannot devolve ...


1

The government uses C, S, and TS as the general material level restriction, but to think that's all they use would be a gross over simplification. Other things in play are "Need to Know" policies -- basically, just because you have TS clearance doesn't mean you get to access everything marked TS. There are far too many to list here, but basically it means ...


1

Maybe you're just looking for the best RSS feeds for the latest info? In that case consider https://packetstormsecurity.com/feeds More specifically, for your needs, I recommend following: https://rss.packetstormsecurity.com/news/tags/goverment/ https://rss.packetstormsecurity.com/news/ Or just follow http://world.einnews.com/news/europe-security 's RSS ...


Only top voted, non community-wiki answers of a minimum length are eligible