• Articles
    • Editorial Articles
    • Research Articles
    • WatchGuard Articles
  • The 443 Podcast
  • Threat Landscape
  • About
    • About Us
    • Contact Us
    • Contribute to Secplicity

Secplicity - Security Simplified

Powered by WatchGuard Technologies

With GDPR, a New Global Data Security Regulatory Cycle Begins

May 17, 2017 By Tracy Hillstrom

gdpr compliance

It’s no surprise that as the stakes associated with a potential breach rise, legislators respond by proposing new privacy and data security laws. However, in replacing an incredibly outdated data security regulation (EU Directive 95/46/EC), the EU has now adopted the General Data Protection Regulation (GDPR) which sets a new benchmark in data security requirements with far reaching impacts and high penalties. So, it’s time for us all to get familiar with the GDPR because it applies to any organization that collects “personal data” from any natural EU citizen, regardless of where a business is located.

Yes, despite being created in the EU, GDPR means that even a five-person company based in Belize with an online storefront that sells to Europeans will be required to comply (or make sure their payment processor complies). Also, “personal data” in the GDPR has a much broader definition than what we’ve settled on as PII, or Personally Identifiable Information, in other regulations. An IP address, for example, is considered personal in the GDPR, even though DHCP and dynamic addresses are used.

To ensure rapid adoption of GDPR, huge potential fines for non-compliance are included and enforcement agencies have been established. The Regulation allows for fines up to 4% of worldwide revenue, or €20 million, whichever is higher.

While the potential fines are high enough to push companies to adhere to GDPR, some are struggling to make the sweeping changes needed before the Regulation takes effect on May 25, 2018.  That’s because the scope of the GDPR is large, and the collection of policy, process and technology changes are difficult and time-consuming to implement.  For example, it mandates:

  • Breach notifications within 72 hours (unless breached data was encrypted)
  • New more-explicit notification practices
  • The ability to display a report of all personal data stored per subject, and then delete at their request
  • That personal data remain in the EU, unless transfer out of the region is authorized
  • A Data Protection Officer to be appointed and Data Protection Impact Assessment completed, where required
  • Data security technology is implemented to ensure situational awareness of risks, and enable preventative, corrective and mitigating action in near real time, as well as provide tools for assessing the effectiveness of security policies

In short, if you are not already working towards compliance, then you are behind the curve and need to quickly ramp up.  WatchGuard provides key information in a GDPR Resource Kit to help you get started.  Visit www.watchguard.com/GDPR to download it today!

Share This:

Related

Filed Under: WatchGuard Articles

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

The 443 Podcast

A weekly podcast featuring the leading white-hat hackers and security researchers. Listen Now
the 443 podcast

Threat Landscape

Filter and view Firebox Feed data by type of attack, region, country, and date range. View Now
threat landscape

Top Posts

  • Cybersecurity News: Free Cybersecurity Training, TrickBot Group Exposed, Major GoDaddy Breach, and Russia to Legalize cybercrime?!
  • US National Cybersecurity Strategy
  • Here Come The Regulations
  • Cybersecurity’s Toll on Mental Health

Email Newsletter

Sign up to get the latest security news and threat analysis delivered straight to your inbox

By signing up you agree to our Privacy Policy.


The views and opinions expressed on this website are those of the authors and do not necessarily reflect the policy or position of WatchGuard Technologies.

Stay in Touch

Recent Posts

  • Cybersecurity News: LastPass Incident Revealed, White House Issues Cybersecurity Strategy, FBI Purchases Leaked USHOR PII Data, and a Slew of Other Breaches
  • An Update on Section 230
  • Here Come The Regulations
  • US National Cybersecurity Strategy
  • Cybersecurity News: Free Cybersecurity Training, TrickBot Group Exposed, Major GoDaddy Breach, and Russia to Legalize cybercrime?!
View All

Search

Archives

Copyright © 2023 WatchGuard Technologies · Cookie Policy · Privacy Policy · Terms of Use