GDPR & Security Practices Training

What the training consists of

1. 

   1. Appropriate measures

   1:56

   The first lesson explains appropriate technical and organisational measures, such as multi-factor authentication, and three steps for each process or system: assess the risk to individuals, choose measures that lower it to an acceptable level, put them in place.

2. 

   2. Privacy by design

   1:58

   Privacy by design, a requirement under the GDPR, means building privacy into every process and system from the start, not adding it later. The second lesson covers the considerations that guide it, from anticipating risks to protecting data until it is deleted.

3. 

   3. Privacy by default

   2:13

   Privacy by default is part of privacy by design and means the default option in any system or process should give the strongest privacy. The last lesson shows it in what customer support staff can see and in the settings of an email program.

Why it matters

The GDPR requires organisations to protect all processing of personal data with appropriate security measures. Those measures keep the data away from people who should not have access and help the organisation avoid data breaches.

What your colleagues learn

• Different data calls for different levels of protection. Patient health data at a clinic needs stronger measures than customer data in a clothing shop, because the risk to the people concerned is not the same.
• Anyone can spot a process that puts personal data at risk. Ideally someone already oversees security measures across the organisation, and they still benefit when a colleague notices a process or system handling personal data insecurely.
• A system can protect privacy and still work well. Privacy measures should not get in the way of what users need a system to do, and those needs should not be met at the cost of privacy.
• Access to personal data is kept to the minimum by default. Personal data, on paper or on screen, should not be open to everyone in the organisation, and a person is given more access only when their work requires it.
• A strong privacy setting is unlikely to be switched off. If an email program encrypts messages and turns off read receipts from the start, users can still relax those settings, but they are unlikely to.