What is General Data Protection Regulation (GDPR)?

The General Data Protection Regulation (GDPR) is a law implemented across all countries in the European Union (EU). It governs the collection, storage and processing of personal data and protects all European citizens from having their personal data misused or insecurely held.

Principles of GDPR

GDPR defines the following principles for the collection, storage and use of personal data:

Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed

(d) accurate and, where necessary, kept up to date

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

(Information Commissioner’s Office 2018)

GDPR Controllers and Processors:

• The controller is defined as the organisation which holds the data and controls how, where and when personal data is processed; they have the main legal obligation
• The processor is the organisation which acts on the controller’s behalf and performs operations on the data; they have the legal obligation for the security of data

• Personal data – a wide-ranging definition but basically anything that can be used to identify a person
• Special category data – sensitive personal data (such as genetics, biometrics etc); there are even more restrictions on the collection and use of sensitive data

GDPR and the Ethical Hacker

GDPR and Incident Responders

• The ethical hacker might sometimes be involved in investigating cyber security breaches
• If things go wrong during a penetration test and some personal information is leaked, we need to make sure that we comply with GDPR and report it

Your task

As GDPR affects any company or organisation holding or processing the personal data of EU citizens, it’s worth familiarising yourself with the regulations in more detail.

Look at the article on GDPR by following the link under ‘Further reading’ at the bottom of the page. Try to assess whether an organisation you are familiar with is complying with the principles of GDPR.

You don’t need to read everything, just get to know the key components of GDPR and identify at least one way in which the organisation is or isn’t compliant. If they aren’t, what do they need to do in order to achieve compliance?

As a guide, you might like to spend around 30 minutes doing this task.

Reference

_{Information Commissioner’s Office (2018) Guide to the General Data Protection Regulation (GDPR) [online] available from https://www.gov.uk/government/publications/guide-to-the-general-data-protection-regulation [25 March 2019]}

Further reading

Guide to the General Data Protection Regulation (Gov.UK) – contains public sector information licensed under the Open Government Licence v3.0