0% found this document useful (0 votes)

823 views131 pages

GDPR P Course v1 1

GDPR practitioner training material.

Uploaded by

Christopher Taylor

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

823 views131 pages

GDPR P Course v1 1

GDPR practitioner training material.

Uploaded by

Christopher Taylor

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 131

TM

EU GDPR
Practitioner Course

IT Governance

GDPR Practitioner v1.1

Welcome
• Housekeeping

– Timings and breaks

– Fire/evacuation

– Mobile phones and other devices

– Security

GDPR Practitioner v1.1

Introductions

Name
Organisation
– What your organisation does
– What your part of the
organisation does
Role
Knowledge/experience
– DPA/GDPR
– Information security
Objectives

GDPR Practitioner v1.1

Getting the most out of this course

GDPR Practitioner v1.1

End of each session: check and confirm

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

EU GDPR Practitioner Course

• Course objectives:
– Enable delegates to fulfil the role of data protection
officer (DPO) under the GDPR;
– Cover the regulation in depth, including
implementation requirements;
– Cover necessary policies and processes,
– Cover important elements of effective data security
management.

GDPR Practitioner v1.1

Case Study Introduction

Baratheon PLC
GDPR Practitioner v1.1
© IT Governance Ltd 2016 7

Baratheon PLC

• Rapidly growing internet marketing and optimisation

specialists
• Started seven years ago as street research
• Developed new proprietary technologies and built market
share based around them
• Expanded into US, Europe and APAC
• Now looking to push into the Chinese market

• ISO/IEC 17024 accredited
• Accredits trainers
• Examination body
• Successful candidate
register:
http://en.gasq.org/registration/
successful-candidate-
register.html

GDPR Practitioner v1.1

IT Governance Ltd: GRC One-Stop-Shop

IT Governance trainers are also practicing consultants

Approx 2.30 pm Exam (90 minutes)

GDPR Practitioner v1.1

Day 1

1. What is personal data?

GDPR Practitioner v1.1

Session 1: Role of the DPO

At the end of this session delegates

will be able to:

LG 2: Understand the role of the Data Protection Officer

GDPR Practitioner v1.1

Data protection officer - requirements

Article 37: Designation of the data protection officer

• Controllers and processors must designate a DPO in three

situations:
– Where the processing is carried out by a public body;
– Where the core activities require regular and systematic monitoring of
data subjects on a large scale;
– Where core activities of controller or processor involve large-scale
processing of sensitive personal data, or personal data relating to
criminal convictions/offences.
• ‘Core’?
• ‘Large scale’?
GDPR Practitioner v1.1
© IT Governance Ltd 2016 21

GDPR Practitioner v1.1

Data protection officer – requirements (cont.)

Article 37: Designation of the data protection officer

– Group undertakings can appoint a single DPO

– Where controller or processor is a public authority a single DPO may be
appointed for several such authorities depending on structure and size
– DPO can represent categories of controllers and processors
– DPO designated on the basis of professional qualities and knowledge of
data protection law, but not necessarily legally qualified
– May fulfill the role as part of a service contract
– Controller or processor must publish DPO details and notify supervisory
authority
– NB: All DPO appointments subject to same rules – mandatory and
voluntary

GDPR Practitioner v1.1

Data protection officer – requirements

(cont.)
Article 38: Position of the data
protection officer
C-Suite/
Legal/Compliance
– Controller and processor must ensure
proper and timely involvement of the DPO
– Controller and processor must provide
support through necessary resources
DPO
– DPO has a large degree of independence
– Protected role within the organisation
– Direct access to highest management
– Data subject has clear access to DPO
Privacy Analyst Privacy Analyst
– Bound by confidentiality in accordance
with EU law
– No conflict of interest arising from
additional tasks or duties

– The DPO should sit within a Risk, Compliance or Governance function
– The role is about ensuring compliance
– You can’t have compliance under the direction of a delivery or functional
team
– Independent of the business with direct access to the Board
– An effective DPO will ensure that privacy is regularly on the board
agenda
– DPO has to be able to work with key functional and line managers
o HR, IT, ISMS, QMS, BCMS
o Line of business managers

GDPR Practitioner v1.1

Role of the DPO?

• Ensure the organization achieves – and maintains –
compliance with the GDPR

• OR

• Keep the organization out of GDPR trouble

GDPR Practitioner v1.1

GDPR Practitioner v1.1

Option 2: Keep the organization out of

trouble!
• Two threat sources:
– Aggrieved data subjects
o Rights to make complaints, seek compensation
– Personal data breaches
o All personal data breaches have to be reported to Supervisory Authority, unless…
• Prioritise:
– Governance
– Identifying what data you have – and on what grounds?
– Eliminating data archives you don’t need/shouldn’t have
– deploying compliant data subject documentation – Privacy notices,
subject access request processes
– Incident response and data breach reporting processes
– Cyber security: make breaches much less likely

GDPR Practitioner v1.1

Data protection officers

The realities of the role of the data protection officer

– Legal knowledge of data protection regulations is necessary but not enough
– Must be able to articulate privacy by design and by default to delivery
functions
– Must also have information security knowledge and skills
o An understanding of how to deliver C, I and A within a management framework
o A good understanding of risk management and risk assessments
– Able to coordinate and advise on data breaches and notification
– Able to make a cyber security incident response process work.
– Able to carry out and interpret internal audits against compliance
requirements
– Familiarity with codes of conduct for industry sector
– A good understanding of compliance standards and data marks
– Lead co-operation with supervisory authority
– Communication skills
GDPR Practitioner v1.1
© IT Governance Ltd 2016 34

Data protection officers

The first 100 days:

1. Which resources are available to the DPO and where are they?
2. What is the reporting structure to ensure independence?
3. How do you get privacy onto the board agenda?
4. What are the key privacy issues in the organisation?
5. Who are the stakeholders of the organisation?
6. What is the applicable legislation for the organisation?
7. What are the appropriate information security standards?
8. What are the appropriate risk frameworks & methodologies?
9. What are the sectoral codes of conduct and how can they be
implemented?
10.Which certifications should the organisation adopt?
11.Who is required to be trained across the organisation and how?

GDPR Practitioner v1.1

Exercise

You are a Baratheon’s newly appointed data

protection officer.
How do you answer the first 4 questions:
1. Which resources are available to the DPO and where are they?
2. What is the reporting structure to ensure independence?
3. How do you get privacy onto the board agenda?
4. What are the key privacy issues in the organisation?

Discussion: is Bank statements or itemised telephone bills

it personal data? A photograph of a crowd taken by a journalist

and the same photo but taken by police officer

House values published on the internet

A medical history, a criminal record, or a record

of a particular individual’s performance at work.

Minutes of a meeting

GDPR Practitioner v1.1

Genetic and biometric data

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Session 3: Accountability, Privacy

Compliance Framework and PIMS
At the end of this session delegates will
be able to:

Learning Goal 1: Understand:

• what a Privacy Compliance Framework is,
• how it helps meet GDPR compliance requirements,
and
• the role that a PIMS can play.

GDPR Practitioner v1.1

The principle of Accountability

• Article 5: Principles relating to processing of personal data

• “The controller shall be responsible for, and be able to
demonstrate compliance with, paragraph 1 ('accountability'). “

1 • Processed lawfully, fairly and in a transparent manner

• Collected for specified, explicit and legitimate purposes

Accountability
2

3 • Adequate, relevant and limited to what is necessary

4 • Accurate and, where necessary, kept up to date

5 • Retained only for as long as necessary

6 • Processed in an appropriate manner to maintain security

GDPR Practitioner v1.1

ICO on accountability

What governance measures for GDPR?

• A policy is a statement of intent.

• Procedures outline what people must do in order to deliver the policy

objectives.

• Guidelines provide advice on how to comply with policies and

procedures.

• Policies are generally adopted by the Board of or senior governance

body within an organisation.

• NB: A ‘privacy policy’ published on a website reflects the overall

corporate data protection policy. It should meet the requirements for
Privacy Notices.

GDPR Practitioner v1.1

Data protection policies

• Policies must:
– Be capable of implementation and enforceable
– Be concise and easy to understand
– Balance protection with productivity
• Policies should:
– State reasons why policy is needed
– Describe what is covered by the policies
– Define contacts and responsibilities
– Include (at least one) objective
– Discuss how violations will be handled

GDPR Practitioner v1.1

Data protection policy document

GDPR Practitioner v1.1

Data protection policy - contents

– Organisation Name is committed to complying with data protection legislation and good practice including:
• processing personal information only where this is strictly necessary for legitimate organisational
purposes;
• collecting only the minimum personal information required for these purposes and not processing
excessive personal information;
• providing clear information to individuals about how their personal information will be used and by whom;
• only processing relevant and adequate personal information;
• processing personal information fairly and lawfully;
• maintaining an inventory of the categories of personal information processed by Organisation Name;
• keeping personal information accurate and, where necessary, up to date;
• retaining personal information only for as long as is necessary for legal or regulatory reasons or, for
legitimate organisational purposes;
• respecting individuals’ rights in relation to their personal information, including their right of subject
access;
• keeping all personal information secure;
• only transferring personal information outside the EU in circumstances where it can be adequately
protected;
• the application of the various exemptions allowable by data protection legislation;
• developing and implementing a PIMS to enable the policy to be implemented;

GDPR Practitioner v1.1

ICO: part of the overall systems

approach?
• Data Protection by Design and by Default
• “Taking into account the nature, scope, context and purposes of processing as well as the
risks of varying likelihood and severity for the rights and freedoms of natural persons, the
controller shall implement appropriate technical and organisational measures to ensure
and to be able to demonstrate that processing is performed in accordance with this
Regulation.” (Article 24-1)
• “Taking into account the state of the art, the cost of implementation and the nature, scope,
context and purposes of processing as well as the risks of varying likelihood and severity
for rights and freedoms of natural persons posed by the processing, the controller shall,
both at the time of the determination of the means for processing and at the time of the
processing itself, implement appropriate technical and organisational measures…designed
to implement data-protection principles in an effective manner and to integrate the
necessary safeguards into the processing in order to meet the requirements of this
Regulation and protect the rights of data subjects.” (Article 25-1)
• “The controller shall implement appropriate technical and organisational measures for
ensuring that, by default, only personal data which are necessary for each specific purpose
of the processing are processed. That obligation applies to the amount of personal data
collected, the extent of their processing, the period of their storage and their accessibility. In
particular, such measures shall ensure that by default personal data are not made
accessible without the individual's intervention to an indefinite number of natural persons “
(Article 25-2) GDPR Practitioner v1.1
© IT Governance Ltd 2016 60

GDPR Practitioner v1.1

What is a privacy compliance

framework?
A privacy compliance
framework links:
• The governance
framework
• The PIMS
• The privacy
principles
So the organization
can ensure it delivers
privacy by design and
by default
GDPR Practitioner v1.1
© IT Governance Ltd 2016 61

Key processes in the privacy compliance

framework
• Compliance (has multiple procedures and work instructions)
– Identifying and implementing necessary privacy activities and controls PIMS
o Privacy notices, legal basis for processing, consent
o Individuals’ rights – erasure, portability, objection etc
• Risk assessment ISMS
– Identifying, assessing and evaluating risks to the privacy of data subjects
– Data protection impact assessments
• Risk treatment
– Selecting, applying and monitoring controls to reduce risks to privacy
• Incident response and data breach reporting
– You will be breached
ISMS
• Contract management
– If you contract with data processors or third parties in relation to personal data
• Data subject access requests
– You will have them; manage them effectively
• Staff awareness and internal communications
GDPR Practitioner v1.1
© IT Governance Ltd 2016 65

Sixth Principle

• Processed in a manner that ensures appropriate security of

the personal data, including protection against unauthorised
or unlawful processing and against accidental loss,
destruction or damage, using appropriate technical or
organisational measures.
• Article 32 covers security requirements more extensively and
needs to be considered alongside the sixth principle.

GDPR Practitioner v1.1

Interpretation – Sixth Principle

• The measures must:

– Ensure a level of security appropriate to the nature of the data and the harm
that might result from a breach of security
– Take account of state of technological developments and costs in doing so
• The data controller must take reasonable steps to ensure the
reliability of any employees who have access to the personal data
• Organisations need to:
– Design and organise security to fit the nature of the personal data held and
the harm that may result from a security breach
– Be clear about who in the organisation is responsible for ensuring
information security
– Make sure there is the right physical and technical security, backed up by
robust policies and procedures and reliable, well-trained staff and
– Be ready to respond to any breach of security swiftly and effectively
GDPR Practitioner v1.1
© IT Governance Ltd 2016 67

‘Appropriate measures’:
Independent standards for PIMS, ISMS

• Privacy - Specification for a personal information management

system
BS • Aligned with GDPR:
• Privacy Policy

10012:2017 • Privacy by Design

• Privacy Impact Assessment
• Currently no certification against this standard

• 27001:2013 Information Security Management System

ISO/IEC • Internationally recognised good-practice information security
framework

27001:2013 • Accredited certification provides assurance to interested parties.

Management systems can be integrated into a single management

system with multiple certifications
GDPR Practitioner v1.1
© IT Governance Ltd 2016 68

Exercise

In designing Baratheon’s privacy compliance

framework,
1. What do you see as being the scope?
2. Apart from the employee personal data, identify two other forms of
personal data it appears to be processing.
3. What structure should you create for accountability?
4. Which inadequate process would you propose to tackle first?

GDPR Practitioner v1.1

Session 3: Accountability, Privacy

Compliance Framework and PIMS

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Session 4: Lessons from Common Data

Security Failures

At the end of this session delegates

will be able to:

LG 3: Identify common data security failures, their

Source: UK Information Commissioner’s Office

GDPR Practitioner v1.1

Data Breaches in the UK

• January to March 2016

• Data Breaches by type
– Loss or theft of paperwork (74)
– Data posted of faxed to wrong recipient (74)
– Data sent by e-mail to wrong recipient (42)
– Webpage hacking (39)
– Failure to redact data (28)
– Insecure disposal of data (24)
– Loss or theft of unencrypted device (20)
– Information uploaded to web page (10)
– Verbal disclosure (7)
– Insecure disposal of hardware (2)
– Other principle 7 failure (128)

Source: UK Information Commissioner’s Office

GDPR Practitioner v1.1

ICO enforcement action and DPA

principles
3- Proportionality,
Count of enforcement 1
5 - Data
action against Principles Retention, 4
1 - Fairness &
Lawfulness, 2

6 - Rights of
individuals, 1

7 - Data Security,
58

GDPR Practitioner v1.1

ICO enforcement action – reasons

Accidental theft or
loss of data,
8% Cyber attack,
Excessive data 5%
held, Unsolicited Inappropriate
1% marketing, disposal of data,
Unlawful processing
of data, 12% 2%
2%

Inappropriate
handling of data,
5%
Unencrypted
storage device lost/
stolen,
13%
Lack of training,
Public disclosure of 19%
sensitive data,
5%

Processing not in Misdirected

line with rights, communications, Lack of
1% 10% sufficient
policy,
16%
Lack of sufficient
contract,
1%
GDPR Practitioner v1.1
© IT Governance Ltd 2016 Source: ICO 77

ICO enforcement action: monetary

penalties
Unlawful retention & Inappropriate
inappropriate disposal,
disposal, £100,000.00
£100,000.00

Unsolicited
Lack of training/ marketing,
policy, £610,000.00
£270,000.00

Public data breach,

£310,000.00

Hack / cyber attack,

£450,000.00
Misdirected
communications,
£315,000.00

Unencrypted data
lost or theft,
£385,000.00

GDPR Practitioner v1.1

A closer look – lessons from common

data security breaches

The Money Shop

fined
£180,000
failing to prevent two data breach
incidents.
GDPR Practitioner v1.1
© IT Governance Ltd 2016 79

Lessons from common data security

breaches
Incident one

A Money Shop store in Northern Ireland had a server stolen

during an overnight burglary. The server was left overnight on a
workstation near a locked fire escape, which the thief used to
gain entry.

GDPR Practitioner v1.1

Lessons from common data security

breaches
Incident two

During transportation between Money Shop headquarters and a

store, a server was lost. The Money Shop had an encryption
programme, but the data on this particular server had not been
fully encrypted at the time of the loss.

GDPR Practitioner v1.1

Lessons from common data security

breaches
Security wasn’t effective

Security in place but it not effective.

Consider layered security -

- locked door is a good start
- second layer of security such as a locked room or safe, or a
form of anchoring device.

Encryption policy and software in place is great but….

- Ensure adherence to policies!
GDPR Practitioner v1.1
© IT Governance Ltd 2016 82

Lessons from common data security

breaches
In the course of its investigation, the ICO determined that:

(1) The Money Shop routinely transported servers with

unencrypted data on a weekly basis between its 521 stores and
its headquarters,

(2) The Money Shop did not delete customers’ information when
that information was no longer required, and

(3) in many stores, there was no secure area to store servers

containing personal information overnight.

GDPR Practitioner v1.1

Lessons from common data security

breaches

Phishing scam hits payroll company, exposing all clients'

W-2 data to criminals

http://www.dailydot.com/layer8/alpha-payroll-services-phishing-
scam-w2-clients/

W-2 statements include an employee’s full name, postal

address, Social Security number, wage and salary information,
how much an employer deducted in taxes, and other employer
information.

GDPR Practitioner v1.1

Exercise

Supervisory authority data breach exercise

Handouts

GDPR Practitioner v1.1

Massive data breaches

• www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/

GDPR Practitioner v1.1

Sony (2011)

• Beginning in April, Sony suffered multiple data breaches involving its PlayStation Network
(PSN), Qriocity, Sony Online Entertainment, and other sites.
• On Sunday, new revelations surfaced that Sony apparently also suffered another data
breach earlier this month, after hackers cracked Sony BMG's website in Greece. That
would make it the seventh data breach suffered by Sony since April 2011.
• In this breach, which occurred on May 5, attackers obtained information about more than
8,000 website users, according to The Hackers News, which received a copy of the
website's SQL database from "b4d_vipera," the hacker who took responsibility for the
breach.
• The attacker also leaked a sample of the purloined database--containing 450 records--to
Pastebin. It contains usernames, passwords for the Sony website, and email addresses.
Security experts recommend that anyone with a Sony BMG account in Greece immediately
change their Sony password, and any other uses of the same password online.
• The attacker said he exploited the Greek Sony website using a SQL injection attack against
the site, which was running Internet Information Server (IIS) 6.0 on Windows 2003. SQL
injection attacks, which exploit website databases that haven't been patched against
known vulnerabilities, are much favored by attackers, in part for their simplicity.
• "It's not something that requires a particularly skillful attacker, but simply the diligence to
comb through Sony website after website until a security flaw is found,"
• Clean up cost $171 million
Information Week
GDPR Practitioner v1.1
© IT Governance Ltd 2016 87

GDPR Practitioner v1.1

Sony (2014)
• On November 25, a new chapter was added to the chronicles of data theft
activity. A group calling itself GOP or The Guardians Of Peace, hacked their way
into Sony Pictures, leaving the Sony network crippled for days, valuable insider
information including previously unreleased films posted to the Internet, and
vague allegations it all may have been done by North Korea in retribution for the
imminent release of an upcoming movie titled “The Interview”.
• While politically motivated attacks and theft of intellectual property is nothing
new, this incident certainly stands out for several reasons. First, via a Pastebin
link, the group released a package and links to torrent files hosted on four sites
consisting of 26 parts, broken out into 25 1GB files, and one 894 MB rar file. The
files were also uploaded to the file sharing giants MEGA and Rapidgator, but
removed by site managers shortly after. The researchers at RBS were able to
access the files and analyze the content prior to the information going off-line,
as well as reach out to GOP.
• The results of the analysis provide unprecedented insight into the inner workings
of Sony Pictures and leaked the personal information of approximately 4,000
past and present employees. As if the sensitive employee information wasn’t
troubling enough, the leak also revealed curious practices at Sony, such as
money orders used to purchase movie tickets that were apparently re-sold back
to Sony staff.

www.riskbasedsecurity.com/2014/12/a-breakdown-and-analysis-of-the-december-2014-sony-hack/
GDPR Practitioner v1.1
© IT Governance Ltd 2016 88

TARGET: Timeline to Resignation

• 27/11/13 – 15/12/13: Target subject to a hack as malware is introduced to 1,800 bricks &
mortar stores
– Probably via a compromised HVAC supplier
• 18/12/13 – investigative reporter breaks the story
• 19/12/13 – Target admits the breach: 40 million records compromised
• 27/12/13 – Target reveals that encrypted PINS were accessed
• 10/1/14 – Target reveals that PII of another 70 million customers was accessed
• Financial impact: revenue down 5%, profits down 50%
• “Target officials have acknowledged that warning signs of computer hacking had been
missed in the weeks before the breach was made public.” The Guardian
• Feb 2014: CFO apologises to Congress: “We have already begun taking a number of steps
to further enhance data security, putting the right people, processes and systems in place.”
• March 2014: CIO resigns
• May 2014: CEO resigns

The data breach at Target that affected 70 million US consumers has cost the retail giant $162 million in 2013 and 2014,
and could end up totaling $1 billion or more in damages before all is said and done.
During its fourth-quarter earnings call, the big-box behemoth said that it booked $4 million related to the breach in Q4,
and $191 million in gross expenses for 2014. It also spent $61 million gross for 2013.
While the gross expenses were in part offset by insurance receivables ($46 million for 2014 and $44 million for 2013),
the losses look to only mount, as lawsuits begin to be filed. Plaintiffs were given the go-ahead for class-action litigation
by a judge in January. (Infosecurity Magazine)
GDPR Practitioner v1.1
© IT Governance Ltd 2016 89

Talk Talk

• TalkTalk lost a third of its value in the wake of the hack, which analysts have
suggested could leave it wide open to a takeover by other quad-play providers.
The company originally came out of Carphone Warehouse in 2003 before being
demerged in 2010 to become one of the biggest LLU telecoms providers in the
UK.
• The high-profile cyber attack, which began on 21 October, appears to have
been the result of a heist masked by a distributed denial-of-service attack
(DDoS).
• Some 28,000 credit and debit card details were stolen, 15,656 bank account
numbers and sort codes were accessed, and around 15,000 dates of birth were
also pinched.
• This adds to the 1.2 million email addresses, names and phone numbers that
were also taken. The credit and debit card details were partially obscured and
are of no use for financial transactions, but the 15,656 bank account details
could be used in cyber theft.
www.theinquirer.net/inquirer/news/2431728/talktalk-ddos-hack-leaves-four-million-customers-at-
risk
• Fourth breach in 12 months
• Reportedly not PCI DSS-compliant
GDPR Practitioner v1.1
© IT Governance Ltd 2016 90

GDPR Practitioner v1.1

Reality: cyber disconnect

• Most organizations are ‘confident’ in their cyber defences

• 70% of organizations say:
– Cyber security completely embedded in their processes
– Cyber security a board-level concern, with top executive focus
• However:
– Organizations face 100+ targeted attacks per year
– 1/3 are successful – that’s 2 or 3 per month!
– Most breaches are discovered by outsiders!

(Accenture: Facing the Cybersecurity Conundrum 2016)

GDPR Practitioner v1.1

5
© IT Governance Ltd 2016 91

Key lessons

• You can have the most compliant documentation (PIMS) in

the world – and still, without an effective ISMS, be massively
breached – occasioning reputation damage, data subject
actions and significant administrative penalties.
• Genuine top management engagement is essential
• DPOs must be able to pro-actively engage with cyber security
teams
• A business risk-based ISMS, customised to incorporate data
privacy impact assessments and data protection by design
and by default is an essential component of the Privacy
Compliance Framework.

GDPR Practitioner v1.1

Exercise

In considering Baratheon’s privacy protection

measures,
1. Identify one specific area where you might guess personal data of
Baratheon staff is inadequately protected;
2. Identify one change in reporting arrangements you might recommend
in order to get a better management focus on information security.

GDPR Practitioner v1.1

Session 4: Lessons from Common Data

Security Failures

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Session 5: The Six Data Privacy

Principles

At the end of this session delegates

will be able to:

LG 4: Understand each of the 6 Data Privacy Principles

and how, in practical terms, to apply them – and to
demonstrate compliance

GDPR Practitioner v1.1

The six privacy principles

• Processed lawfully, fairly and in a transparent manner

• Collected for specified, explicit and legitimate purposes

2
Accountability

• Adequate, relevant and limited to what is necessary

• Accurate and, where necessary, kept up to date

• Retained only for as long as necessary

• Processed in an appropriate manner to maintain security

GDPR Practitioner v1.1

First Principle
Recitals 38, 40-50, 59; Articles 6-10
• Personal data shall be processed fairly and lawfully and, in
particular, shall not be processed unless:
– (a) at least one of the conditions in ARTICLE 6 is met; and
– (b) in the case of sensitive personal data, at least one of the conditions
in Schedule 9 is also met
(’processed fairly and lawfully’)

GDPR Practitioner v1.1

First Principle
Recitals 38, 40-50, 59; Articles 6-10
• In practice, this principle means that you must:
– Have legitimate grounds for collecting and using the personal data
– Not use the data in ways that have unjustified adverse effects on the
individuals concerned
– Be transparent about how you intend to use the data, and give
individuals appropriate privacy notices when collecting their personal
data
– Handle people’s personal data only in ways they would reasonably
expect and
– Make sure you do not do anything unlawful with the data

GDPR Practitioner v1.1

Interpretation – First Principle

Recitals 38, 40-50, 59; Articles 6-10
• Processed ‘fairly’ includes consideration of how data were
obtained – Articles 13 and 14
– Data controller identified
– Data subject must be given information about how information will be
processed
– Must be no deception as to purpose
– Any further information to make sure the processing is fair:
o e.g. any intended disclosure to third parties
• Lawful - Must meet an Article 6 condition relevant for
processing personal data
• Lawful - Must also meet one Article 9 condition if ‘sensitive’
personal data

GDPR Practitioner v1.1

Article 6: Lawfulness of processing

• Processing will only be lawful if one of the following conditions

are met:
– Data subject gives consent for one or more specific purposes;
o More on consent in section 12
– Processing is necessary to meet contractual obligations entered into by
the data subject;
– Processing is necessary to comply with legal obligations of the
controller;
– Processing is necessary to protect the vital interests of the data subject;
– Processing is necessary for tasks in the public interest or exercise of
authority vested in the controller;
– Purposes of the legitimate interests pursued by the controller.

GDPR Practitioner v1.1

• Example
Baratheon’s recruitment agency places workers in a variety of
jobs.
It sends applicants a general questionnaire, which includes
specific questions about health conditions that are only
relevant to particular manual occupations.
• It is be irrelevant and excessive to obtain such information
from an individual who was applying for an office job at
Baratheon.

GDPR Practitioner v1.1

Fourth Principle

• Personal data must be accurate and, where necessary, kept

up to date; every reasonable step must be taken to ensure
that personal data that are inaccurate, having regard to the
purposes for which they are processed, are erased or rectified
without delay; (‘accuracy’)

GDPR Practitioner v1.1

Interpretation – Fourth Principle

• To comply with these provisions you should:

– Take reasonable steps to ensure the accuracy of any personal data
you obtain
– Ensure that the source of any personal data is clear
– Carefully consider any challenges to the accuracy of information and
– Consider whether it is necessary to update the information
• There are regular examples of marketing companies, social
services, local authorities, etc using outdated contact
information.
• What steps should you take to keep up-to-date information of
past employees?
• How do you ensure that customer information on your CRM
system or webshop is still accurate?

GDPR Practitioner v1.1

• The measures must:

GDPR Practitioner v1.1

Interpretation – Sixth Principle

• Organisations need to:

– Design and organise security to fit the nature of the personal data held
hold and the harm that may result from a security breach
– Be clear about who in the organisation is responsible for ensuring
information security
– Make sure there is the right physical and technical security, backed up
by robust policies and procedures and reliable, well-trained staff and
– Be ready to respond to any security incident swiftly and effectively

GDPR Practitioner v1.1

Pseudonymisation

• Definition: ‘the processing of personal data in such a manner that

the personal data can no longer be attributed to a specific data
subject without the use of additional information, provided that such
additional information is kept separately and is subject to technical
and organisational measures to ensure that the personal data are
not attributed to an identified or identifiable natural person.’ (Article
4)
• Recital 26: ‘Personal data which have undergone
pseudonymisation, which could be attributed to a natural person by
the use of additional information should be considered to be
information on an identifiable natural person.’
• Recital 26: To determine whether a natural person is identifiable,
account should be taken of all the means reasonably likely to be
used …. account should be taken of all objective factors, such as
the costs of and the amount of time required for identification, taking
into consideration the available technology at the time of the
processing and technological developments.’
GDPR Practitioner v1.1
© IT Governance Ltd 2016 123

GDPR Practitioner v1.1

Encryption

• Article 33: Do not have to report breaches that do not result in

risk to rights and freedoms…..
• Article 34: Do not have to report breaches to data subjects if
the data was encrypted
• ICO on encryption: “The Information Commissioner has
formed the view that in future, where such losses occur and
where encryption software has not been used to protect the
data, regulatory action may be pursued.”
• Databases and email
• Current encryption standards: FIPS 140-2, FIPS 197
• Hashing is not encryption – the underlying data can be rebuilt
• https://ico.org.uk/for-organisations/guide-to-data-
protection/encryption/implementing-encryption/
GDPR Practitioner v1.1
© IT Governance Ltd 2016 124

Exercise
• Recommend some controls Baratheon should mandate
to protect personal data in the following scenarios:
– Outsourcing its global payroll data to a third party payroll
processor
– Using a third party to create custom-built CRM-type application
software components for its main web technology solution

GDPR Practitioner v1.1

Session 5: The Six Data Privacy

Principles

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Day 1: The Course?

• Queries?

• Understanding?

4 CCMv3, NIST CSF

3 Incident response, business continuity

integration

2 Include SCRM

1
Embedded ISO 27001 ISMS, SOC 2

0 ISO 27001 accreditation

-1 Ten Steps to Cyber Security

-2 PIMS, PCI DSS, 20 Critical Controls, IG Toolkit

-3 Cyber Essentials Plus certification

PCI DSS v3.3 (i of ii)

• Build and Maintain a Secure Network

1. Install and maintain a firewall configuration to protect cardholder data
(23 sub-requirements)
2. Do not use vendor-supplied defaults for system passwords and other
security parameters (12 subs)
• Protect Cardholder Data
3. Protect stored cardholder data (22 subs)
4. Encrypt transmission of cardholder data across open, public networks
(4 subs)
• Maintain a Vulnerability Management Program
5. Protect all systems against malware and regularly update anti-virus
(6 subs)
6. Develop & maintain secure systems and applications (28 subs) -2
GDPR Practitioner v1.1
© IT Governance Ltd 2016 137

PCI DSS v3.3 (ii of ii)

• Implement Strong Access Control Measures

7. Restrict access to cardholder data by business need-to-know
(10 subs)
8. Identify and authenticate access to system components (23 subs)
9. Restrict physical access to cardholder data (27 subs)
• Regularly Monitor and Test Networks
10. Track and monitor all access to network resources and cardholder
data (32 subs)
11. Regularly test security systems and processes (16 subs)
• Maintain an Information Security Policy
12. Maintain a policy that addresses information security for all personnel
(39 subs)
-2
GDPR Practitioner v1.1
© IT Governance Ltd 2016 138

GDPR Practitioner v1.1

Segmented Network

GDPR Practitioner v1.1

The 10 Steps to Cyber Security

Home and User
Incident
Mobile Education &
Management
Working Awareness

Information Risk Management Regime

Managing Removable
User Media Monitoring
Privileges Controls

Secure Malware Network

Configuration Protection Security
-1
GDPR Practitioner v1.1
© IT Governance Ltd 2016 140

ISO 27001 relations

ISO 27001:2013 ISO 27002:2013
Introduction 0 1 Introduction
Application to to Scope and Norm ref.
Terms and definitions 3 ISO 27000:2014 4 Terms and definitions
Structure and Risk Ass.
5
4 6 Security …
to 7 • Control objectives
10 8
• Controls
9
10
11 Control
Security … Annex A: A.5 12
• Control objectives to 13 Implementation
• Controls Annex A: A.18 14 Guidance
15
Bibliography Annex B 16 Other info
17
GDPR Practitioner v1.1 18
© IT Governance Ltd 2016 141

GDPR Practitioner v1.1

Annex A: 14 Control Categories

114 CONTROLS
5 Information security policies

6 Organisation of info. security 7 Human resources security

8 Asset Management 9 Access Control 10 Cryptography

11 Physical & environmental sec 12 Operations security

13 Comms security 14 System acq, dev & mnt. 15 Supplier relationships

16 Info. security incident management 17 Info. sec aspects of BC Mngt

18 Compliance
GDPR Practitioner v1.1
© IT Governance Ltd 2016 142

What is Business Continuity?

Level of Delivery of Products or Services

Business Continuity

Disruptive Incident
Normal level
Recover back
to normal
Minimum
acceptable
level Recover prioritised activities
(with temporary arrangements)
Manage immediate
consequences of
disruptive incident

Time
GDPR Practitioner v1.1
© IT Governance Ltd 2016 143

BCM and ISO 22301

• Business Continuity Management Systems deliver:

• Appropriate level of resilience
o Ensure ability to recover systems or personal data after a physical or technical
disruption
o Systematic approach to analysis of risk and impact of disruption
o Cost-effective resilience
• Resilient work practices that support business goals
• Sustain key products and services through disruption
• Demonstrate commitment to access continuity
• Escalation of cyber incident response (eg DDoS attacks)
should lead to BCP evocation

GDPR Practitioner v1.1

Penetration testing

• External security testing of Internet-facing IP addresses and

URLs
• Internal testing of devices and network infrastructure
• Use accredited ethical hackers
• Vulnerability scanning
• Level 1 testing
• Level 2 testing
• Level 3 testing
– CHECK
– CBEST

GDPR Practitioner v1.1

Session 6: Security of personal data

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Day 2: The DPIA

At the end of the day, delegates will

be able to:

LG 5: Understand the requirements for, as well as when

to conduct, a DPIA
LG 6: Understand how a DPIA links to an organization’s
Risk Management framework
LG 7: Understand how to conduct a Data Mapping
exercise
LG8: Understand how to conduct a DPIA

GDPR Practitioner v1.1

Session 7: Organizational risk

management framework
At the end of this session delegates
will be able to:

LG 6: Understand how a DPIA links to an organization’s

Risk Management framework

GDPR Practitioner v1.1

GDPR and Risk

• Article 32: ‘The controller and the processor shall implement appropriate
technical and organisational measures to ensure a level of security
appropriate to the risk’.
• ‘In assessing the appropriate level of security account shall be taken in
particular of the risks that are presented by processing, in particular from
accidental or unlawful destruction, loss, alteration, unauthorised disclosure of,
or access to personal data transmitted, stored or otherwise processed.’
• ‘Taking into account the nature, scope, context and purposes of processing as
well as the risks of varying likelihood and severity for the rights and
freedoms of natural persons, the controller shall implement appropriate
technical and organisational measures to ensure and to be able to
demonstrate that processing is performed in accordance with this Regulation’”
(Article 24-1)

DPO plays key bridging role between corporate risk

management, broader cyber security risk management and
managing risks to personal data.
GDPR Practitioner v1.1
© IT Governance Ltd 2016 149

Organizations already manage risk

What is Risk?
• The effect of uncertainty on objectives (ISO31000 et al)
• A combination of the likelihood of an incident occurring and
the impact, if it does occur, on the organization.
• A probability or threat of damage, injury, liability, loss, or any
other negative occurrence that is caused by external or
internal vulnerabilities, and that may be avoided through pre-
emptive action (businessdictionary.com)
• Risk can be or

GDPR Practitioner v1.1

Standards and Codes

• ISO 31000: Risk Management – Principles & Guidelines

– AS/NZS 4360:2004 now replaced by ISO31000
• ISO31010: Risk Management - Risk Assessment Techniques
• IRM/ALARM/AIRMIC: A Risk Management Standard
• COSO (Treadway Commission): ERM integrated framework
• Discipline specific, e.g. ISO 27005

GDPR Practitioner v1.1

ISO31000
Principles of the ISO31000 standard
• Risk management:
– Creates value
– Is an integral part of organisational processes
– Is part of decision making
– Explicitly addresses uncertainty
– Is systematic, structured and timely
– Is based on the best available information and is tailored
– Takes human and cultural factors into account
– Is transparent and inclusive
– Is dynamic, iterative and responsive to change
– Facilitates continual improvement and enhancement

GDPR Practitioner v1.1

ISO/IEC 27005 and ISO 31000

Context Establishment

Risk Assessment
Risk Identification
Risk Communication and

Risk Monitoring

Risk Analysis
and Review
Consultation

Risk Evaluation

Risk Decision Point 1 N

Assessment Satisfactory?
Y

Threat actors Attack vectors Threat types Threat

GDPR Practitioner v1.1

Session 7: Organizational risk

management framework

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Session 8: Legal requirements for a

DPIA
At the end of this session delegates
will be able to:

LG 5: Understand the requirements for, as well as when

to conduct, a DPIA

GDPR Practitioner v1.1

Legal requirements for a

DPIA (Data Protection Impact Assessment)

Article 35: Data protection impact assessment

• A DPIA is required:
– where a process is using new technologies, and taking into account the
nature, scope, context and purposes of the processing, there is a high
risk to the rights and freedoms of natural persons
– DPIA is particularly required where:
o Taking into account automated processing including profiling there are legal
effects concerning natural persons;
o The processing is on a large scale of special categories of data or personal
data related to criminal convictions;
o A systematic monitoring of publicly accessible area on a large scale.
– The controller shall seek the advice of the DPO
– Supervisory authority required to publish a list of operations that must
be subject to a DPIA
GDPR Practitioner v1.1
© IT Governance Ltd 2016 163

Legal requirements for a

DPIA (Data Protection Impact Assessment)
• The DPIA will set out as a minimum:
– a systematic description of the processing and purposes;
– legitimate interests (where applicable) pursued by the controller;
– an assessment of the necessity and proportionality of the processing;
– an assessment of the risks to the rights and freedoms of the data
subjects;
– the measures envisaged to address the risks, including
– all safeguards & security measures to protect data and to demonstrate
compliance.
– Compliance with approved codes of conduct should be taken into
account;
– Where appropriate, consult the data subjects.

GDPR Practitioner v1.1

Prior consultation

Article 36: Prior consultation

• Controller shall consult the supervisory authority prior to
processing where the DPIA indicates a “high risk to the rights
and freedoms of the data subjects”:
– Supervisory authority shall provide written advice to the controller
– Request for controller to provide further information
– Information on purposes and means
– Information on measures and safeguards
– The contact details of the DPO
– A copy of the data protection impact assessment
– Any other information requested

GDPR Practitioner v1.1

Session 8: Legal requirements for a DPIA

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Session 9: How to conduct a DPIA

At the end of this session delegates

will be able to:

LG8: Understand how to conduct a DPIA

GDPR Practitioner v1.1

What is a Data Protection Impact

Assessment?

• A process to identify and reduce the privacy risks of a project or a

system.

• An effective DPIA should be initiated and maintained throughout the

development and implementation of a project or system

• Analyse how a particular project or system will affect the privacy

and rights of the data subjects involved.

And, introducing Richard, our colourful DPIA expert…………

At the end of his description of the DPIA process, we’re going to do

a DPIA for Baratheon, using the handout DPIA tool
GDPR Practitioner v1.1
© IT Governance Ltd 2016 168

GDPR Practitioner v1.1

The benefits of a DPIA: transparency

Improve how you use information

Helps individuals understand

how and why their information is being
used.

Which Principles does this address?

GDPR Practitioner v1.1

The benefits of a DPIA: trust

Publish your DPIA to build trust

Which principle does this address?

GDPR Practitioner v1.1

identify and
reduce privacy
risks

GDPR Practitioner v1.1

What do we mean by Privacy Risk?

Risks to individuals: the potential

for damage or distress.

Risks to organisation: financial

and/or reputational impact of a data breach.

privacy

• Hacking
• Virus infection
• Intruders
• Phishing
• Spam
• Inadequate training
Inadequate safeguards for :
• Hard copy
• Portable media
• Smartphones

GDPR Practitioner v1.1

How do we assess the harm and impact?

Identifiability
How easily personal data can be used to
identify specific individuals?

GDPR Practitioner v1.1

How do we assess the harm and impact?

…cont’d

Quantity
How many individuals are identified
in the information (e.g. number of
records)?

GDPR Practitioner v1.1

How do we assess the harm and impact?

…cont’d

Sensitivity and variety of

personal data
Consider the sensitivity of each individual
personal data field, as well as the data
fields together.

GDPR Practitioner v1.1

Examples of where you might use a

DPIA

Database which consolidates A new IT

information held by separate parts system for
of an organisation. storing
and
accessing
personal data.
Monitors members of the public
Unexpected or more
intrusive purpose.

Data sharing initiative

GDPR Practitioner v1.1
© IT Governance Ltd 2016 184

At what point in a project should the DPIA

be conducted?

Applied at a time when it is still

possible to have an impact on the
project.

GDPR Practitioner v1.1

How does DPIA fit with project

management?
DPIAt process should be flexible
and integrated with existing project
management processes.

GDPR Practitioner v1.1

Who has responsibility for conducting

the DPIA?

Data Protection Officer

Asset/risk owner with a tool

for Non-experts and
input from various people in the
organisation

GDPR Practitioner v1.1

What is covered by a DPIA?

• Failure to destroy data

• Inadequate Processes
training

People
Technology
• Inadequate access control
• Encryption

GDPR Practitioner v1.1

What are the 5 key stages?

Step 1 Step 2 Step 3 Step 4 Step 5

Identify need for Describe the Identify privacy Identify and Sign-off and
DPIA information and related evaluate record outcome
flow risks privacy
solutions

GDPR Practitioner v1.1

1. Identifying the need for a DPIA

Ask screening questions to

identify the potential impact on privacy.

Screening process should be embedded into your

organisation’s project management procedures.
GDPR Practitioner v1.1
© IT Governance Ltd 2016 190

What personal data will be processed?

Information about an individual
that is linked or linkable to an
individual. Information identifying
Date of birth, place of birth, race,
religion, weight, geographical personally owned
indicators, employment information, property, such as
medical information, education vehicle registration
information, financial information. number

Address Information, such Telephone numbers,

as street or email address mobile, business,
personal numbers

Personal identification
Name, such as full
number, such as National
name, maiden name, Personal characteristics,
Insurance number, passport
mothers maiden name, including photo (face or
number, drivers licence,
or alias distinguishing features), finger
patient identification number,
financial account or credit prints, biometric data (retina
number scan, etc)
GDPR Practitioner v1.1
© IT Governance Ltd 2016 191

Exercise

List some screening questions you might use

in a DPIA for Baratheon

GDPR Practitioner v1.1

Example screening questions

Will the project involve the collection of new

information about individuals?

Will the project compel individuals to provide

information about themselves?

Will information about individuals be disclosed to

organisations or people who have not previously had
routine access to the information?

Are you using information about individuals for a

purpose it is not currently used for, or in a way it is
not currently used?

GDPR Practitioner v1.1

Example screening questions…cont’d

GDPR Practitioner v1.1

2. Describing information flows

A thorough assessment of privacy risks is only possible if your
organisation fully understands how information is being
used in a project.

You should be able to describe how information is

collected, stored, used and deleted
GDPR Practitioner v1.1
© IT Governance Ltd 2016 199

Example information flow

3rd Party users
HR Users HR
HR
System
Finance
system
Recruitment email Workforce
system metrics

Outplacement services Agency

employment
Outplacement Screening
Recruitment services
data
Outsourced Management
CV
Database
Candidate
information
Candidates

GDPR Practitioner v1.1

3. Identifying privacy and related risks

Assess the corporate risks,

including regulatory action, reputational
damage, and loss of public trust.

Conduct a compliance check

.
against the GDPR and other relevant
legislation.

GDPR Practitioner v1.1

What is your Risk Appetite?

P/L 3 High 3 4 5 P/L 3 High 3 4 5
2 Med 2 3 4 2 Med 2 3 4
1 Low 1 2 3 1 Low 1 2 3
Low Med High Low Med High
1 2 3 1 2 3
Impact Impact

P/L 3 High 3 4 5 P/L 3 High 3 4 5

2 Med 2 3 4 2 Med 2 3 4
1 Low 1 2 3 1 Low 1 2 3
Low Med High Low Med High
1 2 3 1 2 3
Impact Impact

GDPR Practitioner v1.1

Mapping risks to your Risk Acceptance

Criteria

Likely (3) 3 4 15
Occasional (2) 2 3 4 43
Likelihood

Unlikely (1) 1 2
2 3

Low (1) Medium (2) High (3)

Terminate
Transfer
Tolerate
Treat
Discussion: List examples of each risk option

GDPR Practitioner v1.1

Exercise…cont’d

Risk Vulnerability Impact Likelihood Risk

Decision
Inadequate Lack of training and High High Treat
disclosure controls lack of sufficient
policy.

Information is Inadequate retention Moderate Low Tolerate

collected and policy
stored indefinitely.
3rd Party data Inadequate 3rd Party High Moderate Treat
breach Contract

Accidental theft or Inadequate High Moderate Treat

loss of data encryption

GDPR Practitioner v1.1

How do you bring risks down to an

acceptable level?

Likely (3) 3 4 15
Occasional (2) 2 3
4 43
Likelihood

Unlikely (1) 1 2 3

Low (1) Medium (2) High (3)

Impact

GDPR Practitioner v1.1

4. Identifying and evaluating privacy

solutions

Balance
the project’s outcomes with
the impact on individuals.

Discussion:
What controls
could be used
to reduce the
risks described
in the example
HR system?

GDPR Practitioner v1.1

Example HR database – Risk to

individuals
Risk Impact Likelihood Risk Decision Risk
Treatment
Inadequate disclosure High High Treat Develop privacy policy.
controls. Communicate and test
via training and
awareness
programme.
Information is collected Moderate Low Treat Develop retention
and stored indefinitely. policy

3rd Party data breach High Moderate Tolerate Appropriate clauses in

contracts

Accidental theft or loss High Moderate Transfer Encrypt

of data

GDPR Practitioner v1.1

Examples of risk treatment

• Reduce data collected

• Retention policy
• Secure destruction of information
• Access control
• Training and awareness
• Anonymise information
• Contracts or data sharing agreements
• Acceptable use policy
• Subject access request process
• External supplier risk assessments

GDPR Practitioner v1.1

Assess the costs and benefits

Risk Acceptance

Controls
implemented

Cost

Vulnerabilities

Number of Controls

GDPR Practitioner v1.1

5. Signing off and recording the DPIA

outcomes

• Produce DPIA report

• Obtain sign-off (risk committee / supervisory authority)
• Publish the report / make summary available to
stakeholders.

GDPR Practitioner v1.1

5. Signing off and recording the DPIA

outcomes

• Report should include an overview of the project

• Describe the impact on privacy

• Describe the data flows
• Describe the privacy risks and associated treatment

Linking the PIA to the Privacy Principles

• Processed lawfully, fairly and in a transparent manner

• Collected for specified, explicit and legitimate purposes

Accountability
• Adequate, relevant and limited to what is necessary
3

• Accurate and, where necessary, kept up to date

• Retained only for as long as necessary

• Processed in an appropriate manner to maintain security

GDPR Practitioner v1.1

Linking the DPIA to the Data Protection

Principles
Principle 1
• Personal data shall be processed fairly and lawfully

• Have you identified the purpose of the project?

• How will individuals be told about the use of their personal
data?
• Do you need to amend your privacy notices?
• Have you established which conditions for processing apply?
• If you are relying on consent to process personal data, how
will this be collected and what will you do if it is withheld or
withdrawn?

GDPR Practitioner v1.1

Linking the DPIA to the Data Protection

Principles
Principle 2
• Purpose limitation

• Does your project plan cover all of the purposes for

processing personal data?

• Have potential new purposes been identified as the scope

of the project expands?

GDPR Practitioner v1.1

Linking the DPIA to the Data Protection

Principles
Principle 3
Data minimisation

• Is the information you are using of good enough quality for the
purposes it is used for?
• Which personal data could you not use, without compromising
the needs of the project?

GDPR Practitioner v1.1

Linking the DPIA to the Data Protection

Principles
Principle 4
Accuracy

• If you are procuring new software does it allow you to amend

data when necessary?
• How are you ensuring that personal data obtained from
individuals or other organisations is accurate?

GDPR Practitioner v1.1

Linking the DPIA to the Data Protection

Identify Identify Understand

personal appropriate legal & Trust and
technical and regulatory confidence
data organisational obligations
safeguards

GDPR Practitioner v1.1

What is an information flow?

A transfer of information of information from one location to

another.

GDPR Practitioner v1.1

Describing information flows

Walk through the information

lifecycle to
identify unforeseen or unintended
uses of the data

Ensure the people who will be using

the information are consulted on the
practical implications.

Consider the potential future uses

of the information collected, even if it is not
immediately necessary.
GDPR Practitioner v1.1
© IT Governance Ltd 2016 234

GDPR Practitioner v1.1

Information flow - Identify the key

elements
Data Items
Name, email, address Health data, Criminal Biometrics, Location
records data
Formats
Hardcopy (paper records Digital (USB) Database
Transfer methods
Post, Telephone, Social Internal (within group) External (data sharing)
Media
Locations
Offices Cloud 3rd Parties

GDPR Practitioner v1.1

Data flow mapping - questions to ask

• Workflow inputs and outputs

– How is the personal data collected (e.g. form, online, call centre, other)?
– Who is accountable for the personal data ?
– Location of the systems/filing systems containing the data?
– Who has access to the information?
– Is the information disclosed / shared with anyone (e.g suppliers, 3rd
parties)?
– Does the system interface / transfer information with other systems?

GDPR Practitioner v1.1

EU GDPR
Practitioner Course
DAY 3
IT Governance

GDPR Practitioner v1.1

Day 3

11. The Rights of Data Subjects

GDPR Practitioner v1.1

Session 11: The Rights of Data Subjects

At the end of this session delegates

will be able to:

LG 9: Understand the rights of Data Subjects

GDPR Practitioner v1.1

The Rights of data subjects:

From principles to specific obligations….
Article 6.
Lawfulness

Article 7.
Lawful Consent

Article 8. Childs
1.Fair and lawful
consent

Article 13.
2.Specific
Fair Information to be
purpose(s)
provided

3. Minimum
necessary
Article 5
Principles
4. Accurate

5. Retention

6. Security

GDPR Practitioner v1.1

Eight Rights of Data Subjects

1. The right to be informed

2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling.

GDPR Practitioner v1.1

1. Right to be informed
Privacy Notice (Recital 39, 42, 58, Article 13, 14)
Not
Data obtained
Requirement obtained
directly
directly
Identity and contact details of the controller and where applicable, the
controller’s representative) and the data protection officer Y Y
Purpose of the processing and the legal basis for the processing Y Y
The legitimate interests of the controller or third party, where applicable
Y Y
Categories of personal data Y Y
Any recipient or categories of recipients of the personal data Y Y
Details of transfers to third country and safeguards Y Y
Retention period or criteria used to determine the retention period Y Y
The existence of each of data subject’s rights Y Y
The right to withdraw consent at any time, where relevant Y Y
The right to lodge a complaint with a supervisory authority Y Y
The source the personal data originates from and whether it came from
publicly accessible sources Y Y
Whether the provision of personal data part of a statutory or contractual
requirement or obligation and possible consequences of failing to provide
the personal data Y Y
The existence of automated decision making, including profiling and
information about how decisions are made,GDPR the significance
Practitioner v1.1 and the
consequences. © IT Governance Ltd 2016 Y Y 247

3. Right to rectification
Art 12, 15, Recital 63, 64
Conditions on when rectification applies

• If personal data is inaccurate or incomplete.

• If you have disclosed the personal data in question to third
parties, you must inform them of the rectification where
possible.

You must also inform the individuals about the third parties
to whom the data has been disclosed where appropriate

You must respond within one month

• Can be extended to 2 months if request is complex

GDPR Practitioner v1.1

4. Right to erasure (‘right to be forgotten’)

Not an absolute right….

Applies in specific circumstances

• Processing is no longer necessary in relation to purpose

• Data subject withdraws consent
• Data subject objects to processing (and there is no legitimate
interest for ongoing processing)
• Processing is unlawful
• Processing has to be erased to comply with legal obligation

GDPR Practitioner v1.1

4. Right to erasure

You may refuse a request to erase personal data where:

• You need to comply with legal obligation (to keep the data)
• For vital interests or public interest
• Archiving in relation to public interest, scientific/historic and
statistical research
• Exercise of legal claims

GDPR Practitioner v1.1

4. Right to erasure

Children’s data
(Recital 38)

– GDPR requires specific protection to be applied to processing children's

data as they may be less aware of the risks (when providing consent –
especially in relation to social networking)
– Recital 38: ‘Such specific protection should, in particular, apply to the
use of personal data of children for the purposes of marketing or
creating personality or user profiles and the collection of personal data
with regard to children when using services offered directly to a child.
The consent of the holder of parental responsibility should not be
necessary in the context of preventive or counselling services offered
directly to a child.’

GDPR Practitioner v1.1

4. Rights to erasure
Recital 66

Informing other organisations of the erasure

• You must inform 3rd parties processing personal data

unless it involves disproportionate effort to do so.
– erase any links or copies of the data
• Take into consideration the available technology and
means available.

GDPR Practitioner v1.1

5. Right to restrict processing

Recital 68, Articles 12, 20

Restriction - you may retain data that has been suppressed on

the condition it is not further processed.

Conditions on when the right to restrict processing applies:

• Individual contests the accuracy of the personal data.

• Individual has objected to the processing for the purpose of
legitimate interests.
• If the processing is unlawful and the individual opposes erasure and
requests restriction instead.
• If you no longer need the personal data but the individual requires
the data to establish, exercise or defend a legal claim.

You must inform individuals when you decide to lift a restriction

on processing
GDPR Practitioner v1.1
© IT Governance Ltd 2016 257

processing unless: -

• you can demonstrate compelling legitimate grounds for the

processing, which override the interests, rights and freedoms of the
individual; or
• the processing is for the establishment, exercise or defence of legal
claims.

You must inform individuals of their right to object “at the point of
first communication” and in your privacy notice.

GDPR Practitioner v1.1

7. Right to object
Recital 67, Articles 18, 19

Demonstrating compliance:

If you process personal data for research purposes

• Individuals must have “grounds relating to his or her particular

situation” in order to exercise their right to object
• Where the processing of personal data is necessary for the
performance of a public interest task, you are not required to
comply with an objection to the processing.

GDPR Practitioner v1.1

8. Rights related to automated decision

making and profiling
Recital 71, 72, Articles 4, 9, 22
Conditions on when right ‘not to be subjected to an automated
decision’ apply:

• it is based on automated processing; and

• it produces a legal effect or a similarly significant effect on the
individual.

You must ensure that individuals are able to:

• obtain human intervention;
• express their point of view; and
• obtain an explanation of the decision and challenge it.

GDPR Practitioner v1.1

8. Rights related to automated decision

making and profiling
Recital 71, 72, Articles 4, 9, 22

• Automated decisions taken for the purposes listed in Article

9(2) must not:
• concern a child; or
• be based on the processing of special categories of data
unless:
– you have the explicit consent of the individual; or
– the processing is necessary for reasons of substantial public interest

GDPR Practitioner v1.1

8. Rights related to automated decision

making and profiling
Recital 71, 72, Articles 4, 9, 22
Conditions for profiling, you must: -

• Provide meaningful information about the logic involved, as

well as the significance and the envisaged consequences.
• Use appropriate mathematical or statistical procedures for the
profiling.
• Implement appropriate technical and organisational measures
to enable inaccuracies to be corrected and reduce errors.
• Secure personal data in a way that is proportionate to the risk

GDPR Practitioner v1.1

Article 9: Processing of special

categories of personal data
• Processing of following types of personal data are prohibited:
– Race
– Ethnic origin
– Political opinions
– Religion
– Philosophical beliefs
– Trade union membership
– Genetic data
– Biometric data
– Health data
– Concerning a natural person's sex life
– Sexual orientation.

GDPR Practitioner v1.1

Article 9: Processing of special

categories of personal data
Conditions for processing special categories of data:

– The data subject has given explicit consent;

– It is necessary to fulfill the obligations of controller and data subject;
– It is necessary to protect the vital interests of the data subject;
– Processing is carried out by a foundation or not-for-profit organisation;
– The personal data has been made public by the data subject;
– Establishment, exercise or defence of legal claims;
– Reasons of public interest in the area of public health;
– Archiving purposes in the public interest;
– A Member State has varied the definition of a special category.

GDPR Practitioner v1.1

GDPR says consent:

GDPR Practitioner v1.1

Withdrawing consent

GDPR Practitioner v1.1

Session 13: Handling Data Subject

Access Requests (DSAR)

At the end of this session delegates

will be able to:

LG 11: Understand how to handle a subject access

request

GDPR Practitioner v1.1

2. Right of access
Art 12, 15, Recital 63, 64

Subject Access - What are the Key Stages ?

Step 1 Step 2 Step 3 Step 4 Step 5

Recognize a Validate the Handle Redaction Maintain

DSAR request, proof requests made records
of: on behalf of: • Remove 3rd
party data
• Photo ID • 3rd parties
• Address • Children • Remove
data exempt
from
disclosure

GDPR Practitioner v1.1

‘Simple’ access requests

• Single location for data

• No 3rd parties included in the data
• May involve DPO to validate disclosure

GDPR Practitioner v1.1

‘Complex’ access requests

– Letter
– Email
– Orally
– Social Media – Facebook, Twitter etc.

GDPR Practitioner v1.1

Session 13: Handling Data Subject Access

Requests

• Queries?

• Understanding?

• Implementation?

operations which is performed upon personal
data or sets of personal data, whether or not
by automated means, such as collection,
recording, organization, structuring, storage,
adaptation or alteration, retrieval, consultation,
use, disclosure by transmission, dissemination
or otherwise making available, alignment or
combination, erasure or destruction;

GDPR Practitioner v1.1

Data controllers

Controllers determine:
• the legal basis for collecting data;
• which items of personal data to collect, ie the content of the
data;
• the purpose or purposes the data are to be used for;
• which individuals to collect data about;
• whether to disclose the data, and if so, who to;
• whether subject access and other individuals’ rights apply ie
the application of exemptions; and
• how long to retain the data or whether to make non-routine
amendments to the data.

GDPR Practitioner v1.1

General obligations
Article 24: Responsibility of controller
Adhere
to codes
of
conduct

Controller

Implement Implement
data technical and
protection organizational
measures
policies

GDPR Practitioner v1.1

Data processors

Within the terms of the agreement with the data controller, and its
contract, a data processor may decide:
• what IT systems or other methods to use to collect personal data;
• how to store the personal data;
• the detail of the security surrounding the personal data;
• the means used to transfer the personal data from one organisation
to another;
• the means used to retrieve personal data about certain individuals;
• the method for ensuring a retention schedule is adhered to; and
• the means used to delete or dispose of the data.

GDPR Practitioner v1.1

Exercise
Controller or Processor?
Market research company
A bank contracts a market research company to carry out
some research. The bank’s brief specifies its budget and
that it requires a satisfaction survey of its main retail
services based on the views of a sample of its customers
across the UK. The bank leaves it to the research
company to determine sample sizes, interview methods
and presentation of results.

GDPR Practitioner v1.1

Exercise
Controller or Processor?
Payment services
An online retailer works in co-operation with a third-party
payment company to process customers’ transactions.

GDPR Practitioner v1.1

Exercise
Controller or Processor?
Accountants
A firm uses an accountant to do its books.

GDPR Practitioner v1.1

GDPR Practitioner v1.1

Codes of conduct and certification

Article 40: Codes of conduct

• Codes of conduct available at national and European level.

• Associations and other representative bodies with regard to:
– fair and transparent processing;
– the legitimate interests pursued by controllers in specific contexts; i.e.
the collection of personal data;
– the pseudonymisation of personal data;
– the information provided to the public and to data subjects;
– the exercise of the rights of data subjects;

GDPR Practitioner v1.1

Session 12: Roles of, and Relationships

between, controllers and processors

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Session 13: Personal data, international

organizations, non-EEA states and the EU-
US Privacy Shield

At the end of this session delegates

will be able to:

LG 13: Understand how to comply with GDPR

requirements covering international organizations, non-
EEA states (includes cloud data storage) and the EU-US
Privacy Shield

GDPR Practitioner v1.1

Transfer of personal data to third

countries or international organisations
Article 44: General principle for transfers
• Any transfer of personal data by controller or processor shall
take place only if certain conditions are complied with:
a. Transfers on the basis of adequacy;
b. Transfers subject to the appropriate safeguards
c. Binding corporate rules apply.

• All provisions shall be applied to ensure the protection of

natural persons is not undermined.

GDPR Practitioner v1.1

Transfer of personal data to third countries or

international organisations
Recitals 103-107, 169, Article 45

a) Transfers on the basis of adequacy

• A transfer may take place where there is an adequate level of
protection.
• The adequacy criteria:
– the rule of law;
– respect for human rights and fundamental freedoms;
– relevant legislation, both general and sectoral, including:
o concerning public security;
o defence;
o national security; and
o criminal law.
• Official Journal of the European Union (published on the EU
Commission website)

GDPR Practitioner v1.1

Transfer of personal data to third countries or

international organisations
Recitals 103-107, 169, Article 45

a) Transfers on the basis of adequacy

No restrictions on transfers to EEA Countries

GDPR Practitioner v1.1

Transfer of personal data to third countries or

international organisations
Recitals 103-107, 169, Article 45

a) Transfers on the basis of adequacy

The following additional countries are considered by the EU as
having adequate data protection laws:

Andorra Guernsey New Zealand

Argentina Isle of Man Switzerland
Canada Israel Uruguay
Faroe Islands Jersey

GDPR Practitioner v1.1

Transfer of personal data to third

countries or international organisations
a) Transfers on the basis of adequacy

The GDPR limits your ability to transfer personal data outside the EU
where this is based only on your own assessment of the adequacy of the
protection afforded to the personal data.

• Authorisations of transfers made by Member States or supervisory

authorities and decisions of the Commission regarding adequate safeguards
made under the Directive will remain valid/remain in force until amended,
replaced or repealed.

GDPR Practitioner v1.1

Transfers of personal data

Recital 108-10, 114, Article 46
b) Transfers subject to appropriate safeguards
Adequate safeguards include:

• a legally binding agreement between public authorities or bodies;

• standard data protection clauses in the form of template transfer
clauses adopted by the Commission;
• standard data protection clauses in the form of template transfer
clauses adopted by a supervisory authority and approved by the
Commission;
• compliance with an approved code of conduct approved by a
supervisory authority;
• certification under an approved certification mechanism as provided for
in the GDPR;
• contractual clauses agreed authorised by the competent supervisory
authority; or
• provisions inserted in to administrative arrangements between public
authorities or bodies authorised by the competent supervisory authority.
GDPR Practitioner v1.1
© IT Governance Ltd 2016 313

Transfer of personal data to third countries or

international organisations
Recitals 111, 112, Article 49
Derogations – GDPR provides derogations from the general prohibition on
transfers of personal data outside the EU for certain specific situations.

Conditions on when a derogation applies:

• made with the individual’s informed consent;

• necessary for the performance of a contract between the individual and the
organisation or for pre-contractual steps taken at the individual’s request;
• necessary for the performance of a contract made in the interests of the
individual between the controller and another person;
• necessary for important reasons of public interest;
• necessary for the establishment, exercise or defence of legal claims;
• necessary to protect the vital interests of the data subject or other persons,
where the data subject is physically or legally incapable of giving consent; or
• made from a register which under UK or EU law is intended to provide
information to the public (and which is open to consultation by either the public
in general or those able to show a legitimate interest in inspecting the register).

GDPR Practitioner v1.1

Transfer of personal data to third countries or

international organisations
Recitals 113, Article 49
What about one-off (or infrequent) transfers of personal data
concerning only relatively few individuals?

One-off transfer are permitted only where the transfer:

• is not being made by a public authority in the exercise of its public powers;
• is not repetitive (similar transfers are not made on a regular basis);
• involves data related to only a limited number of individuals;
• is necessary for the purposes of the compelling legitimate interests of the
organisation (provided such interests are not overridden by the interests of the individual)
• is made subject to suitable safeguards put in place by the organisation (in the
light of an assessment of all the circumstances surrounding the transfer) to protect the
personal data.

In these cases, organisations are obliged to inform the relevant

supervisory authority of the transfer and provide additional information to
individuals.
GDPR Practitioner v1.1
© IT Governance Ltd 2016 315

model contract clauses as ‘stand-alone contracts’ you cannot
change the clauses in any way (other than to add an
additional party, such as an additional data importer).

• The model contract clauses may be incorporated into other

contracts (such as data processing service agreements)
provided nothing in the other contract or additional clauses
alters the effect of any of the model clauses.
GDPR Practitioner v1.1
© IT Governance Ltd 2016 319

Model Contract Clauses as a basis for

transferring personal data outside the EEA
Drawbacks with the use of contracts

• Potentially hundreds of contracts are required to cover

transfers between all entities.
• Burden to ensure contracts are kept up to date to keep pace
with the changing corporate structure can be difficult and time
consuming.

GDPR Practitioner v1.1

Privacy Shield
Applies to transfers to US only
• The decision on the EU-U.S. Privacy Shield was adopted by
the European Commission on 12 July, 2016

Commercial sector U.S Government

Strong obligations on access
companies and robust Clear safeguards and
enforcement transparency obligations

Redress Monitoring
Directly with the company Annual joint review
With the data protection mechanism between US
authority Department of commerce
Privacy shield panel and EU Commission

GDPR Practitioner v1.1

Privacy Shield
Applies to transfers to US only

Why should an organization that

previously participated in the Safe
Harbor program self-certify to the
Privacy Shield?

• The Privacy Shield Framework was

deemed adequate by the European
Commission.
• Participating organizations are
deemed to provide “adequate”
privacy protection,
• Compliance requirements of the
Privacy Shield Framework are clearly
laid out and can be implemented by
small and medium-sized enterprises.
GDPR Practitioner v1.1
© IT Governance Ltd 2016 325

Apps & Cloud Services

GDPR Practitioner v1.1

GDPR: Controllers or processors outside

the EU
Article 27: Representatives of controllers or processors not
established in the Union
– Recital 23: In order to determine whether such a controller or processor is offering
goods or services to data subjects who are in the Union, it should be ascertained
whether it is apparent that the controller or processor envisages offering services to
data subjects in one or more Member States in the Union. Whereas the mere
accessibility of the controller's, processor's or an intermediary's website in the Union,
of an email address or of other contact details, or the use of a language generally
used in the third country where the controller is established, is insufficient to ascertain
such intention, factors such as the use of a language or a currency generally used in
one or more Member States with the possibility of ordering goods and services in that
other language, or the mentioning of customers or users who are in the Union, may
make it apparent that the controller envisages offering goods or services to data
subjects in the Union.
• Where the controller or the processor are not established in the Union:
– They shall designate in writing a representative in the Union;
– Representative shall be established where data processing or profiling resides;
– The representative shall be mandated to be addressed by supervisory authorities and
data subjects for the purposes of the Regulation;
– Designation of representative does not absolve controller or processor from legal
liabilities.
GDPR Practitioner v1.1
© IT Governance Ltd 2016 330

GDPR Practitioner v1.1

GDPR: Cloud processor obligations

Policy and procedure requirements
Article 28: Processor
A legal contract must ensure that the processor:
• processes the personal data only on documented instructions from the
controller;
• ensures that persons authorised to process the personal data observe
confidentiality;
• takes appropriate security measures;
• respects the conditions for engaging another processor;
• assists the controller by appropriate technical and organisational
measures;
• assists the controller in ensuring compliance with the obligations to
security of processing;
• deletes or returns all the personal data to the controller after the end of
the provision of services;
• makes available to the controller all information necessary to
demonstrate compliance with the Regulation.

GDPR Practitioner v1.1

International transfers & Cloud providers

• The Cloud is not automatically territorially limited

• Any transfer of personal data by controller or processor shall take
place only if certain conditions are complied with:
– Transfers on the basis of adequacy;
– Transfers subject to the appropriate safeguards
– Binding corporate rules apply.
• All provisions shall be applied to ensure the protection of natural
persons is not undermined.
• To countries with similar data protection regulations
– Cloud providers are a key risk area
– Highest penalties apply to breaches of these provisions
• Cloud providers need to ensure they are able to differentiate their
EU and non-EU provision and provide clarity to data subjects and
controllers
GDPR Practitioner v1.1
© IT Governance Ltd 2016 332

Cloud Controls Matrix

• Application & Interface Security (controls AIS-01 to 03)

• Audit Assurance & Compliance (AAC-01 to 03)
• Business Continuity Management & Operational Resilience (BCR-01 to 12)
• Change Control & Configuration Management (CCC-01 to 05)
• Data security & Information Lifecycle Management (DSI-01 to 08)
• Datacentre Security (DCS-01 to 09)
• Encryption & Key Management (EKM-01 to 04)
• Governance and Risk Management (GRM-01 to 12)
• Human Resources (HRS-01 to 12)
• Identity & Access Management (IAM-01 to 13)
• Infrastructure & Virtualization Security (IVS-01 to 12)
• Interoperability & Portability (IPY-01 to 5)
• Mobile Security (MOS-01 to 20)
• Security Incident Management, E-Discovery & Cloud Forensics (SEF-01 to 05)
• Supply Chain Management, Transparency and Accountability (STA-01 to 09)
• Threat and Vulnerability Management (TVM-01 to 03)

GDPR Practitioner v1.1

Cloud-based services

• Controller still needs legitimizing reason for transfer;

• Data protection principles still apply;
• Use of model clauses meets the above requirement;
• Obligation is on the data controller to ensure compliance with
law;
• Obligation on the data controller to inform data subjects of
transfer.

GDPR Practitioner v1.1

Exercise
• Identify, in Baratheon’s relationship with Calamity Jane,
the roles of both parties in relation to one another and in
relation to the personal data that is processed within
that relationship.
• Identify the key contractual requirements that need to be
in place.
• Identify any exposures either organization may have in
terms of trans-border data flows

GDPR Practitioner v1.1

Session 13: Personal data, international

organizations, non-EEA states and the EU-US
Privacy Shield

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Day 3: The Course?

• Queries?

• Understanding?

and how to comply with the GDPR’s data breach
reporting requirements
LG 15: Understand the range of enforcement,
regulatory and compensatory aspects of the GDPR
LG 16: Understand how to transition to, and
demonstrate compliance with, the GDPR

GDPR Practitioner v1.1

Session 16: Incident response and data

breach reporting

At the end of this session delegates

will be able to:

LG 14: Understand incident response

management and how to comply with the data
breach reporting requirements

GDPR Practitioner v1.1

Article 33: Personal data breaches

• The definition of a Personal Data Breach in GDPR:

– A 'personal data breach' means a breach of security leading to the

accidental or unlawful destruction, loss, alteration, unauthorised
disclosure of, or access to, personal data transmitted, stored or
otherwise processed.
– Discussion:
o What steps are necessary to ensure personal data breaches are reported
internally?
o What steps are necessary to reduce the likelihood of the range of possible
personal data breaches?

GDPR Practitioner v1.1

Article 33: Personal data breaches

• Obligation for data processor to notify data controller

– Notification without undue delay after becoming aware
– No exemptions
– All data breaches have to be reported
– EDPB to issue clarification with regard to ‘undue delay’

GDPR Practitioner v1.1

Article 33: Personal data breaches

• Obligation for data controller to notify the supervisory authority
– Notification without undue delay and not later than 72 hours
– Unnecessary in certain circumstances
– Description of the nature of the breach
o Categories of data
o Approximate numbers of records and data subjects affected
– Describe likely consequences
– Describe measures taken – or to be taken – to mitigate the breach
– Communicate details of the Data Protection Officer
– No requirement to notify if unlikely to result in a high risk to the rights and
freedoms of natural persons
– Failure to report within 72 hours must be explained
– Controller must document personal data breaches, effects and remedial
action – to enable assessment of compliance with these requirements
– EDPB to issue further clarification with regard to “undue delay”

GDPR Practitioner v1.1

Article 34: Personal data breaches

• Obligation for data controller to communicate a personal data

breach to data subjects
– Communication to the data subject without undue delay if high risk
– Communication in clear plain language
– Supervisory authority may compel communication with data subject
– Exemptions if:
o appropriate technical and organisational measures taken
o High risk to data subject will not materialise
o Communication with data subject would involve disproportionate effort

GDPR Practitioner v1.1

Session 14 – Incident response and data

breach reporting

Policy expected to commit• Dutchto satisfy e-Gov applicable

requirements, sp. laws and regulations, MS will not
guarantee full compliance at any particular point in
time. Under such circumstances, it should not be
considered out of conformance so long as prompt
detection and corrective action of the system
deficiencies that contributed to the instance(s) of
noncompliance. Draft guidance doc. for Tech Committees
GDPR Practitioner v1.1
© IT Governance Ltd 2016 346

Breach landscape

• Not if, but when

• Being prepared is key
• Develop the resilience to respond
• Don’t wait until after the event
• 72 hour window to respond
• How and when you respond goes towards mitigation
• Incident response mandated in ISO27001, ISO 22301, PCI
DSS

GDPR Practitioner v1.1

Incident response: top ten challenges

• Organisations can have significant difficulty in responding to cyber

security incidents, particularly sophisticated cyber security attacks.
• The top ten challenges organisations face in responding to a cyber
security incident in a fast, effective and consistent manner are:
– Identifying a suspected cyber security incident;
– Establishing the objectives of an investigation and a clean-up operation;
– Analysing all available information related to the potential cyber security incident;
– Determining what has actually happened;
– Identifying what systems, networks and information (assets) have been compromised;
– Determining what information has been disclosed to unauthorised parties, stolen,
deleted or corrupted;
– Finding out who did it and why;
– Working out how it happened;
– Determining the potential business impact of the cyber security incident;
– Conducting sufficient investigation using forensics to identify those responsible.

GDPR Practitioner v1.1

CREST Cyber incident response process

• Prepare:
– Conduct a criticality assessment;
o Which critical systems are most likely to be breached?
– Carry out a cyber security threat analysis;
o Which threats are most likely to succeed
– Consider the vulnerabilities in people, process, technology and
information, including weaknesses in defence in depth
– Analyse and assess the risks.
– Identify additional control requirements;
– Review your state of readiness for cyber security incident response

GDPR Practitioner v1.1

CREST Cyber incident response process

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Session 17: Enforcement, regulatory

and compensatory issues

At the end of this session delegates

will be able to:

LG 15: Understand the range of enforcement,

regulatory and compensatory aspects of the
GDPR

GDPR Practitioner v1.1

Enforcement, regulatory and

compensatory issues

GDPR Practitioner v1.1

Remedies, liability and penalties

Article 77: Right to lodge a complaint with a supervisory

authority

– Every data subject has the right to launch a complaint with a

supervisory authority
– In Member State of habitual residence
– Place of work
– Place of alleged infringement

• Supervisory authority shall inform the complainant of

progress, including the possibility of judicial remedy

GDPR Practitioner v1.1

Remedies, liability and penalties

Article 78: Right to an effective judicial remedy against a

supervisory authority

– Right to judicial remedy against a legally binding decision.

– Right to judicial remedy where the supervisory authority does not handle
a complaint or does not inform data subject of progress or outcome.
– Judicial remedy shall be brought before the courts of the Member State
where the supervisory authority is established.
– Supervisory authority must provide opinion or decision of the Board to
the court.

GDPR Practitioner v1.1

Remedies, liability and penalties

Article 79: Right to an effective judicial remedy against a

controller or processor

– Right to judicial remedy where their rights have been infringed as a

result of the processing of personal data.
– Proceedings shall be brought before the courts of the Member State
where the controller or processor has an establishment.
– Proceedings may be brought before the courts of the Member State
where the data subject habitually resides.

GDPR Practitioner v1.1

Remedies, liability and penalties

Article 82: Right to compensation and liability

– Any person who has suffered material, or non-material, damage shall

have the right to receive compensation from the controller or processor.
– Controller involved in processing shall be liable for damage caused by
processing.
– Processor liable only for damage caused by processing or where it has
acted contrary to lawful instructions of the controller.
– Exemption for controller and processor where they are not responsible.
– Joint and several liability to ensure effective compensation.
– Compensation clawback provision.

GDPR Practitioner v1.1

Remedies, liability and penalties

GDPR Practitioner v1.1

Remedies, liability and penalties (cont.)

Article 83: General conditions for imposing administrative fines
• € 10,000,000 or, in case of an undertaking, 2% total worldwide annual turnover in the preceding
financial year (whichever is greater):
• Articles
– 8: Child’s consent
– 11: Processing not requiring identification
– 25: Data protection by design and by default
– 26: Joint controllers
– 27: Representatives of controllers not established in EU
– 26 - 29 & 30: Processing
– 31: Cooperation with the supervisory authority
– 32: Data Security
– 33: Notification of breaches to supervisory authority
– 34: Communication of breaches to data subjects
– 35: Data protection impact assessment
– 36: Prior consultation
– 37 - 39: DPOs
– 41(4): Monitoring approved codes of conduct
– 42: Certification
– 43: Certification bodies

GDPR Practitioner v1.1

Remedies, liability and penalties (cont.)

Article 83: General conditions for imposing administrative fines

• € 20,000,000 or, in case of an undertaking, 4% total worldwide
annual turnover in the preceding financial year (whichever is higher)
• Articles
– 5: Principles relating to the processing of personal data
– 6: Lawfulness of processing
– 7: Conditions for consent
– 9: Processing special categories of personal data (i.e. sensitive personal
data)
– 12 - 22: Data subject rights to information, access, rectification, erasure,
restriction of processing, data portability, object, profiling
– 44 - 49: Transfers to third countries
– 58(1): Requirement to provide access to supervisory authority
– 58(2): Orders/limitations on processing or the suspension of data flows

GDPR Practitioner v1.1

Session 17: Enforcement, regulatory and

compensatory issues

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Session 18: Transition to, and demonstrating

compliance with, the GDPR

At the end of this session delegates

will be able to:

LG 16: Understand how to transition to, and

demonstrate compliance with, the GDPR

GDPR Practitioner v1.1

Accountability & governance framework

• Brief the board on GDPR – risks and rewards

• Board support for a GDPR compliance project
– Resources (people, money, time)
– Top management support (tone from the top)
• Accountable director
• Incorporate data protection risk into corporate risk
management and internal control framework
• Create a project team
• Establish the DPO

GDPR Practitioner v1.1

Scope and plan project

GDPR Practitioner v1.1

Detailed gap analysis

• Once you have details about exactly what data flows where,
how, to whom, and in what format, you can
• Assess detailed compliance with
– Data privacy principles
– Requirements on controllers and processors
– Appropriate technical and organizational measures
– Trans-border data flows

GDPR Practitioner v1.1

Create/improve key processes

compliance with, the GDPR

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

Final session: Summary and recap

GDPR Practitioner v1.1

Recap – New concepts in GDPR

• Accountability
• Transparency
• Children’s data
• Definition of personal data
• Pseudonymisation
• Data breach reporting
• Enhanced rights
• European data protection board

GDPR Practitioner v1.1

Principles...from 8 to 6

1 • Lawful and Fair

2 • Specific Purpose

3 • Adequate, relevant, not excessive

4 • Accurate and up to date

5 • Retention

6 • Rights – no longer a principle - Chapter 3

7 • Security

8 • Transfers – no longer a principle – Chapter 5

Recap – 2 new rights

• Right to be forgotten
• Right to data portability

GDPR Practitioner v1.1

Recap – Mandatory Breach reporting

• Must report breaches within 72 hours

• Not necessary to notify where breach is “unlikely to result in a
risk for the rights and freedoms” of data subjects;

GDPR Practitioner v1.1

Recap – Data subject access

• Fee abolished
• Time period reduced from 40 days to 1 month

GDPR Practitioner v1.1

Recap – Obligations of controllers and

processors
• Processors are now liable for processing only
• Data protection by design and default
• Controllers or processors outside EU must designate a
representative where the data processing or profiling resides.
• Specific requirements for legal contracts
• Accountability
– Maintain records of processing activities
– Appoint DPO where appropriate

GDPR Practitioner v1.1

Practitioner (C-GDPR-P) exam

• IBITGQ examination
• ISO/IEC 17024-certified exam
• 90 minutes
• 40 questions
• 65% pass mark

GDPR Practitioner v1.1

Day 4: The Course?

• Queries?

• Understanding?

• Implementation?

GDPR Practitioner v1.1

The course?

• Queries?

• Understanding?

• Implementation?

• Join us on LinkedIn: www.linkedin.com/company/it-governance

• Join us on Facebook: www.facebook.com/ITGovernanceLtd

GDPR Practitioner v1.1

CIPM Exam - Page 6 - ExamTopics
No ratings yet
CIPM Exam - Page 6 - ExamTopics
10 pages
GDPR Essentials for Data Handlers
83% (6)
GDPR Essentials for Data Handlers
60 pages
307 - EU GDPR Implementation Project Plan
100% (1)
307 - EU GDPR Implementation Project Plan
9 pages
Supplier GDPR Compliance Guide
No ratings yet
Supplier GDPR Compliance Guide
6 pages
Truste GDPR Readiness Assessment Sample
100% (3)
Truste GDPR Readiness Assessment Sample
6 pages
Privacy Program Management Guide
No ratings yet
Privacy Program Management Guide
17 pages
Cipm Ebp 1.2.3
No ratings yet
Cipm Ebp 1.2.3
1 page
Six Ways: Privacy Awarenesstraining Will Transform Your Staff
No ratings yet
Six Ways: Privacy Awarenesstraining Will Transform Your Staff
4 pages
Top X GDPR Assessment Tools
100% (1)
Top X GDPR Assessment Tools
17 pages
Privacy Management Accountability Framework-GDPR Edition
100% (1)
Privacy Management Accountability Framework-GDPR Edition
1 page
CIPT Certification Study Guide
No ratings yet
CIPT Certification Study Guide
18 pages
NOREA Privacy Control Framework v1.0
100% (1)
NOREA Privacy Control Framework v1.0
68 pages
CIPM Exam - Page 5 - ExamTopics
100% (1)
CIPM Exam - Page 5 - ExamTopics
26 pages
CIPM Exam Q&A PDF Guide
No ratings yet
CIPM Exam Q&A PDF Guide
6 pages
1 - Defradar - GDPR Implementation Guide v2
100% (1)
1 - Defradar - GDPR Implementation Guide v2
18 pages
GDPR Accountability Checklist - (1p)
100% (1)
GDPR Accountability Checklist - (1p)
1 page
Data Protection Officer Requirements by Country
100% (1)
Data Protection Officer Requirements by Country
8 pages
Iapp - Actualtests.cipm - Practice.test.2022 Oct 26.by - Reuben.113q.vce
No ratings yet
Iapp - Actualtests.cipm - Practice.test.2022 Oct 26.by - Reuben.113q.vce
15 pages
Getting Started: With Privacy in Canada
No ratings yet
Getting Started: With Privacy in Canada
4 pages
Privacy Frameworks 1 3 1690900933
No ratings yet
Privacy Frameworks 1 3 1690900933
2 pages
CIPM Onl ResourcesandBoKMapping
No ratings yet
CIPM Onl ResourcesandBoKMapping
18 pages
CIPM Exam Dumps & Privacy Insights
No ratings yet
CIPM Exam Dumps & Privacy Insights
20 pages
Privacy Program Management
50% (2)
Privacy Program Management
182 pages
Defradar - Supplier GDPR Assessment
No ratings yet
Defradar - Supplier GDPR Assessment
2 pages
Data Subject Rights Request Guide
No ratings yet
Data Subject Rights Request Guide
15 pages
Example GDPR Data Mapping Impact Assessment
0% (1)
Example GDPR Data Mapping Impact Assessment
24 pages
IAPP Glossary - 158 Terms
No ratings yet
IAPP Glossary - 158 Terms
17 pages
9.CIPM Onl Mod9Transcript
No ratings yet
9.CIPM Onl Mod9Transcript
17 pages
Data Protection Audit Guide
80% (10)
Data Protection Audit Guide
23 pages
CIPPE FSG November - 2018 - v1
No ratings yet
CIPPE FSG November - 2018 - v1
14 pages
5.CIPM Onl Mod5Transcript
100% (1)
5.CIPM Onl Mod5Transcript
15 pages
Legend Register of Processing Activities Ropa
100% (1)
Legend Register of Processing Activities Ropa
12 pages
1.CIPM Onl Mod1Transcript
100% (1)
1.CIPM Onl Mod1Transcript
10 pages
IAPP Introduction To Privacy For Technology
100% (2)
IAPP Introduction To Privacy For Technology
501 pages
CIPP/E Module 1 and Chapter 1 Summary
No ratings yet
CIPP/E Module 1 and Chapter 1 Summary
7 pages
Privacy Manager Certification
No ratings yet
Privacy Manager Certification
7 pages
Skillcast GDPR Training Presentation
100% (3)
Skillcast GDPR Training Presentation
24 pages
GDPR Compliance Checklist For Data Controllers
No ratings yet
GDPR Compliance Checklist For Data Controllers
13 pages
CIPT BOK v.3.0.0
No ratings yet
CIPT BOK v.3.0.0
6 pages
What Is GDPR
No ratings yet
What Is GDPR
5 pages
CIPPE-Bibliography-2 0 0 - GDPR
No ratings yet
CIPPE-Bibliography-2 0 0 - GDPR
3 pages
CIPP-E Exam Prep for IT Pros
No ratings yet
CIPP-E Exam Prep for IT Pros
23 pages
Accountability Roadmap For Demonstrable GDPR Compliance
100% (2)
Accountability Roadmap For Demonstrable GDPR Compliance
70 pages
Mauritius Data Protection Updates 2023
No ratings yet
Mauritius Data Protection Updates 2023
10 pages
DPIA Guide for University Staff
No ratings yet
DPIA Guide for University Staff
8 pages
IAPP CIPM Exam Questions
0% (1)
IAPP CIPM Exam Questions
3 pages
Data Protection Impact Assessment Policy
100% (1)
Data Protection Impact Assessment Policy
29 pages
GDPR Data Protection Impact Assessments Tool - Res - Eng - 0917
100% (2)
GDPR Data Protection Impact Assessments Tool - Res - Eng - 0917
27 pages
IAPP Privacy Certification Candidate Handbook
100% (1)
IAPP Privacy Certification Candidate Handbook
54 pages
Conducting A Privacy Audit
100% (1)
Conducting A Privacy Audit
3 pages
All About A Data Protection Impact Assessment (DPIA) : Andrey Prozorov, CISM, CIPP/E, CDPSE, LA 27001
100% (1)
All About A Data Protection Impact Assessment (DPIA) : Andrey Prozorov, CISM, CIPP/E, CDPSE, LA 27001
60 pages
HR Employee Data Toolkit For GDPR
No ratings yet
HR Employee Data Toolkit For GDPR
30 pages
Data Protection Audit Self-Assessment Toolkit
100% (1)
Data Protection Audit Self-Assessment Toolkit
41 pages
Best Practices For Privacy Audits
No ratings yet
Best Practices For Privacy Audits
4 pages
CIPM Exam Reviewer
No ratings yet
CIPM Exam Reviewer
48 pages
Defradar - Data Subject Request Form
No ratings yet
Defradar - Data Subject Request Form
2 pages
CIPPE FSG November - 2018 - v1
No ratings yet
CIPPE FSG November - 2018 - v1
11 pages
CIPT Certification Resource Guide
0% (1)
CIPT Certification Resource Guide
2 pages
GDPR Compliance for Businesses
No ratings yet
GDPR Compliance for Businesses
13 pages
English Preparation Guide PDPP 201911
No ratings yet
English Preparation Guide PDPP 201911
16 pages
Basic Civil Engineering Assignment
0% (1)
Basic Civil Engineering Assignment
28 pages
Emc Networker Release 7.6 Service Pack 1: Performance Optimization Planning Guide
No ratings yet
Emc Networker Release 7.6 Service Pack 1: Performance Optimization Planning Guide
58 pages
AKA ROBOTICS TECHNOLOGY Co., LTD.
No ratings yet
AKA ROBOTICS TECHNOLOGY Co., LTD.
24 pages
Fiber Optic Network PDF
100% (1)
Fiber Optic Network PDF
2 pages
MetaTrader 4 Advisor Installation Guide
No ratings yet
MetaTrader 4 Advisor Installation Guide
37 pages
Bidirectional Flyback Inverter With
No ratings yet
Bidirectional Flyback Inverter With
5 pages
Transient - TS1S - Complete
No ratings yet
Transient - TS1S - Complete
14 pages
Adjust 1
No ratings yet
Adjust 1
2 pages
Topas Brochure English
No ratings yet
Topas Brochure English
20 pages
Toto Residential Catalog 2010
No ratings yet
Toto Residential Catalog 2010
40 pages
Timer, Counter
No ratings yet
Timer, Counter
7 pages
DS WasteWaterTreatment ISP 0318 ENG PDF
No ratings yet
DS WasteWaterTreatment ISP 0318 ENG PDF
2 pages
Ecm Aveo x1
100% (1)
Ecm Aveo x1
3 pages
Building Logbook Etisalat Data Center
No ratings yet
Building Logbook Etisalat Data Center
82 pages
Intl' Sub
No ratings yet
Intl' Sub
184 pages
Colombo Housing Project Progress
No ratings yet
Colombo Housing Project Progress
8 pages
IRCTC Next Generation Eticketing System
No ratings yet
IRCTC Next Generation Eticketing System
4 pages
2700-Series PRV - Intalacion Mantenimiento
100% (1)
2700-Series PRV - Intalacion Mantenimiento
14 pages
Compilation of ARCHITECTURAL STRUCTURAL PLUMBING ELECTRICAL PLAN Edolmo Liwanag Jr. Sangalang VIno CE 302
93% (15)
Compilation of ARCHITECTURAL STRUCTURAL PLUMBING ELECTRICAL PLAN Edolmo Liwanag Jr. Sangalang VIno CE 302
12 pages
Waterproofer Ecosystem East
No ratings yet
Waterproofer Ecosystem East
264 pages
Microwave Landing System
100% (1)
Microwave Landing System
7 pages
2nd NCSBE Poster 2019
No ratings yet
2nd NCSBE Poster 2019
2 pages
Soil Health JOE
No ratings yet
Soil Health JOE
7 pages
Root Cause Analysis Tools
No ratings yet
Root Cause Analysis Tools
15 pages
Electrical Resonance and Signal Filtering: 1 Abstract
No ratings yet
Electrical Resonance and Signal Filtering: 1 Abstract
18 pages
Sap Fico Tutorial
No ratings yet
Sap Fico Tutorial
7 pages
List of Analytics Consulting Companies in India
No ratings yet
List of Analytics Consulting Companies in India
3 pages
TVET Trainer Certification Guide
No ratings yet
TVET Trainer Certification Guide
7 pages
Master DFT in One Day
No ratings yet
Master DFT in One Day
14 pages
Thryve - 2
No ratings yet
Thryve - 2
149 pages