GDPR Explainedsentia.events/files/GDPR-Explained_2017 - Sentia.pdfGDPR Legislation Translate GDPR...

GDPR Explained

Jan Smets @ GDPR Event 18/05/2017

Pre-Sales Manager

DPO Certified

GDPRis enforced

for EVERY ORGANISATION

(unless household use)

18/05/2017GDPR Explained2

Step by step

GDPR EXPLAINED

GDPR Legislation

Translate GDPR for your specific situation

Go and read the legislation:

English

French

NOTE: skip the first part, and start from Chapter 1, read the rest later

Public authority or body (except courts)

Core activities (regular / systematic / large scale)

Monitoring of data subjects

Special categories *

Criminal convictions and offences

Each country can define more rules for appointing DPO

DPO: Special categories

Racial or ethnic origin

Political opinions

Religious or philosophical beliefs

Trade union membership

Genetic & biometric data for identifying a natural person

Health

Sex life or sexual orientation

Consent & Rights

Easy to give and withdraw consent

Children (-16) need parental consentCan be (-13) in some countries

Rightsto rectification

to erasure

to be forgotten

to restriction of processing

to data portability

Roadbook / Data Register

Never ending story …

Write down all:ResearchFindingsDecisionsActionsRisks…EVERYTHING

Obligation from 250+ employees

Necessary for GDPR compliance!

Data classification

Find PII (Personal Identifiable Information)

Where are they stored?

Who has access?

Who are they shared with?

Which applications process the data?

Priority

Top priorities

Start with data/application:

Most private data

Highest risk of data breach

Use PIA / DPIA

Legacy vs. New application

Procedures & policies

People are and will stay the weakest link

Use procedures / policies

NOT to annoy employees

BUT to keep them on the right track

Privacy by Design: Allow but monitor

Data protection

Production data

Back-ups

Historical data (full detail)Limitations apply

Historical data (analytics)

Encryption

Tokenization

Pseudonymization

Anonymization

Assess & document other risks

Find all other risks

Assess

Document

Revise and repeat

Revise outcome previous steps

Change where necessary

Find next priority

Repeat steps 4 to 6

Overview

1. Legal framework / Understand GDPR

2. Create roadbook / Data register

3. Data classification

4. Start with top priorities

4a. Procedures & Policies

4b. Data protection

5. Assess & document other risks

6. Revise & repeat

In short

Legal aspects

Documentation

Privacy By Design

Privacy By Design – 7 principles

Proactive & Preventative

Default setting

Embedded in design

Positive-sum

End-to-end security

Visibility and transparency

User-centric

Gemalto vision

GDPR EXPLAINED

A new mindset

Accept the Breach

Protect What Matters,

Where It Matters

Secure the Breach

Perimeter security alone is no

longer enough.

Data is the new perimeter.

Attach security to the data and

applications. Insider threat is

greater than ever.

Gemalto Research: www.breachlevelindex.com

Three pilars

Authentication

GDPR EXPLAINED

Why two-factor authentication?

Audit trail for GDPR compliancy

who accessed

at what time

which information

Reduce risk for stolen credentials

Breach prevention

SafeNet Authentication Service by the Numbers

Over 4.000.000 users of Cloud Edition

30 minutes to set up

400+ fully-tested integrations

60% lower TCO than other solutions

99.999% Availability SLA

SafeNet Authentication Service

Broad Choice of 2FA Methods and Tokens• OTP, OOB and pattern-based authentication with hardware, software and tokenless form factors• Over-the-air provisioning of tokens ideal for remote staff, partners and contractors

Fully Automated Management• Define policies once, and enforce them throughout your IT ecosystem• Automated user & token lifecycle administration, self-service portals • automated alerts and reporting

Standards-based Security• ISO 27001:2013, AICPA SOC-2 Recognition• FIPS 140-2 validated software tokens, DSKPP-secured provisioning• Hardware-based root of trust (token secrets and encryption keys secured in an HSM)• DSKPP secure provisioning for software tokens

Shared Services with Multi-tier Multi-tenant Architecture • Allows delegation of administration to local or remote staff• Shared services model enables accounting and inventory management per BU• Fully customizable security policies, fully brandable interface

Cloud Efficiencies• Extend current identities to the cloud with native identity federation via SAML 2.0 • Up to 60% savings in deployment and day-to-day administration costs

Broad Use Case Support• VPN, VDI, cloud, network access, portals

PKI: Protecting Identities and Data

• Large enterprises

• Governments and local

municipalities

• Healthcare organizations

• Critical infrastructure

• Law enforcement

• Financial services

OUR CLIENTS

Management & Software

OUR SOLUTIONS

Middleware

Authenticators & Readers

MobilePKI

Crypto / Data protection

GDPR EXPLAINED

Why encryption?

Lost or stolen data in terms of GDPR

Only breach notification

No user information duty

No secrets revealed

No bad publicity

Less business impact

Breach prevention

Top HSM Use Cases

Public Key Infrastructure

Transparent Data Encryption

SSL/TLS Private Key Protection

Code Signing

Data Protection for Cloud Apps

TDE ProtectFile

ProtectFileProtectApp

Files, Folders, or Shares

WHERE DOES THE SENSITIVE DATA RESIDE?

File Level

Databases

Selected

Columns

Database Files

ProtectV

Block Level

System

TokenizationProtectApp

Encrypt Tokenize

ProtectDB

Database

The correct connector … for every use-case

Tokenization

ProtectVProtectFile

ProtectApp

KeySecure Platform

Distributed Key Management

ProtectDB

• Key and crypto engine

• Authentication and authorization

• Key lifecycle management

• SNMP, NTP, SYSLOG

File Servers

& SharesWeb & Application

Servers

DatabasesApplication

ServersVirtual Machines

KeySecure Platform

Data Controller / Processor

SaaSSoftware-as-a-service

PaaSPlatform-as-a-service

IaaSInfrastructure-as-a-service

Data Flow

Application

Database

File / OS

Virtual Machine

Processor

Controller

Processor

Controller

Processor

Contr. / Proc. Controller

Controller

Processor

ProtectDB | TDE (Native DB Encryption) ProtectDB | TDE (Native DB Encryption) ProtectDB | TDE (Native DB Encryption)

ProtectV | KMIP ProtectV | KMIP ProtectV | KMIP

Key Management

GDPR EXPLAINED

Why Key Management?

No direct GDPR compliancy requirement

BUT when encrypting data:

Data is no longer important

But Key Management is!

Central key management

A new mindset

KeySecure or

Virtual KeySecure

Luna HSM or

Cloud HSM

Crypto Command Center

SafeNet Data Encryption Solutions / Crypto Management Platform

Signing

Webserver

Gateway

Payment

Transactions

File & Disk

Encryption

Customer

KMIP Client

Backup,

Storage &

GDPR Explainedsentia.events/files/GDPR-Explained_2017 - Sentia.pdfGDPR Legislation Translate GDPR...

Documents

GDPR in plain English | Business Data Prospects · 2020. 7. 22. · GDPR in plain English Keywords: GDPR, Business Data Prospects, BDP Agency, GDPR Advice, Advice, GDPR Plain English,

Payslip Compliance with GDPR · 2020-01-13 · Payslip Compliance with GDPR Payslip Compliance with GDPR Ensuring your Payslips are compliant with GDPR GDPR changes coming in May

Roadmap to the GDPR - The Extraterritorial Reach of the GDPR

GDPR Best Practices Implementation Guide news items/GDPR... · 2020. 3. 30. · This GDPR Best Practices Guide puts forward a GDPR implementation methodology designed to: • Engage

2018 GDPR COMPLIANCE REPORT · Among the many articles that make up the GDPR legislation, the right to be forgotten and erasure (article 17) and secure processing of personal data

BRITISH MODEL FLYING ASSOCIATION General Data Protection (GDPR…btckstorage.blob.core.windows.net/site11032/GDPR/BMFA... · 2018-05-11 · 5 GDPR 2018 V1.1 12 Steps to GDPR Compliance

JANUAR 2018 AVIATION - Holman Fenwick Willan · legislation en route (e.g. GDPR in the EU), heightened public awareness, privacy campaigns and activism. Immigration The provisions

No Longer “Nice to Have”...European General Data Protection Regulation (GDPR) Came into Effect: May 25, 2018 Scope: • Comprehensive legislation granting unprecedented data privacy

Language Identification in Bilingual Documents for ...Tdszyman/Misc/Plc37.pdfGoogle Translate '06 Google Translate '07 Google Translate '08 Google Translate '09 Google Translate '10

GDPR - HOW IS INDUSTRY ADDRESSING THE LEGISLATION© PA Knowledge Limited 2017 PUBLIC 1 GDPR - HOW IS INDUSTRY ADDRESSING THE LEGISLATION 25 January 2017

“91% of healthcare orgs have had a data breach” - …...What is GDPR? The General Data Protection Regulation (GDPR) is a new piece of legislation that was agreed in December 2015,

Achieving GDPR compliance - IT Governance · Euro-vision: The Regulation intends to harmonise data protection legislation. across the 28 member states. • Controllers have to demonstrate

GDPR - HOW IS INDUSTRY ADDRESSING THE LEGISLATION...•GDPR, PCI-DSS, ISO27001 Compliance PA examples: Designed a programme to protect a nuclear power stations from cyber threats Designed

GDPR & NIS: Impacts since May 2018 - University of Oulu 2018 Quirchmayr.pdf · Expected Legislative Impacts of GDPR and NIS 2 New legislation coming into effect (mainly) in 2018 •

SYMPHONY’S GDPR COMPLIANCE STRATEGYs GDPR Compliance Strategy.pdfSYMPHONY’S ROLE UNDER THE GDPR The GDPR distinguishes two roles that organisations can play: controllers and processors

GDPR & HR infographic - Workday · GDPR & HR GDPR harmonises different EU country data privacy regulations into a single set of regulations GDPR by (some of) the numbers GDPR comes

How does the General Data Protection Regulation (GDPR) affect … does GDPR affect your business.pdf · • GDPR is intended toharmonize data protection lawacross the EU • GDPR

MySQL + GDPR

General Data Protection Regulation (GDPR)...− Ideally gain accreditation prior to implementation of GDPR legislation in May 2018 Maintaining investment in your security ISO27001

How Blackboard’s GDPR implementation supports our clients...GDPR – WHAT YOU NEED TO KNOW The GDPR is the new EU data protection legislation that will replace the current EU Data