Hot answers tagged

3

There is no definitive list of PII that should be encrypted. Encryption is a security control that mitigates risk. There are many other controls than can achieve the same result. So, you need to perform a risk assessment to determine what stakeholders require, what regulatory/legal obligations you have and what risks you face that could be mitigated with ...


2

This is probably a question that should be in Law.SE, but I'll try to write a quick answer anyway. As far as I know, the users have no right to know any technical details or know how security controls are implemented. However, I believe that data controllers and data processors have the right to request specific technical details from other data processors ...


1

No, a right to know how a controller (in terms of the GDPR) technically ensures confidentiality does not exist. GDPR however provides the user of a service the right to know what data are stored in the service's data base, and their purpose in this database The Right of access by the data subject (Article 15) says a controller shall inform you about which ...


1

It depends on the purposes and permissions you have to use user data. Encryption is not really means of blocking third party access to the data. Databases per se are protected, so data access is already restricted to outsiders. It is more that encryption is a way for you as data processor not to have access to data that you're not supposed to have access to, ...


Only top voted, non community-wiki answers of a minimum length are eligible