IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [gdpr]

For questions regarding the implementation of and impacts on design and operations in light of the EU General Data Protection Regulation.

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/

58 questions
3
votes
2 answers

Should passwords and challenge questions & answers be migrated?

I am currently working on the migration of a user Identity and Access Management tool from a legacy platform (product + solution) to a new one (same product but upgraded + updated solution) My team was challenged with the following…
Hugo Tavares
  • 31
  • 2
2
votes
3 answers

Google Drive and GDPR

I can't seem to find much information on this online, and forgive me if this is obvious to other folks in the info-sec community but would storing documents such as CVs of applicants, letters written for an employee by HR etc. on a shared/Google…
Anon
  • 21
  • 2
2
votes
1 answer

Receiving Junk Email that is related to Skype conversations

My Microsoft email address and account are linked to Skype, OneDrive and Windows 10 (products I use by Microsoft). This account is not linked to my phone (Android). I don't use this account for Email (I use Gmail for email). Absolutely sure I don't…
Nuno
  • 215
  • 2
  • 7
2
votes
1 answer

Steps to make website GDPR Compliant

I am working for a high traffic website developed in codeigniter. Can someone please help how to start working to make website GDPR compliant? Till now, I was able to identify the potential cookies being used containing user personal details. What…
Arun Jain
  • 153
  • 1
  • 1
  • 8
2
votes
1 answer

EU GDPR - Data protection requirement standards missing?

I'm reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like Mimimum password length requirements Second factor authentication Backup protection policies and the like. What about a data…
Marcel
  • 3,494
  • 1
  • 18
  • 35
1
vote
1 answer

Risk scenarios when hosting KEK in Google Cloud KMS HSM backended

For some time now, we have been assessing the risks from a GDPR perspective when data (data-at-rest) in the Google Cloud is fully encrypted using native means. This means that we create both the KEK and the DEK completely with Google Cloud KMS and…
rsfeed
  • 9
  • 1
1
vote
0 answers

How do I make sure the information I collect on a person does not constitute personal data/PII?

I'm building an application that may involve the storage of certain information pertaining to potentially millions users of a popular social media platform for analytics purposes, making the obtaining of consent almost impractical (if not…
moonman239
  • 121
  • 4
1
vote
0 answers

Choosing the right salt to pseudo-anonymize data and be GDPR compliant

In my company, numeric user IDs are considered PIIs and therefore need to be pseudo-anonymized to be GDPR compliant. To do so, we populate a lookup table where to each ID is assigned a monotonically decreasing gdpr_ID. Then when users are inactive…
Vektor88
  • 111
  • 2
1
vote
0 answers

How do we reconcile a requirement to keep backups, with a requirement that we be able to purge data on request?

As part of SOC 2 preparation (and just general operational best-practice) we take regular PostgreSQL backups and keep them for up to a year. One of our partners has a requirement that we be able to delete any data sourced from them on request,…
recurser
  • 11
  • 1
1
vote
2 answers

publication of GDPR implementation

I'm aware of this post that GDPR apparently does not enforce a specific standard to secure sensible data. Based on this post e.g., there is no requirement to encrypt or hash login data in a local database, either. GDPR however provides the user of…
Buttonwood
  • 113
  • 3
1
vote
2 answers

What personal data should be encrypted in a database?

I am having trouble answering what seems like a simple question. I was hoping to find a Yep/Nope style list somewhere, but can't seem to find one. What data should be encrypted in a cloud (e.g. AWS/Azure) database? I have researched ICO as well as…
JsAndDotNet
  • 165
  • 1
  • 1
  • 5
1
vote
0 answers

How have you secured production data (PII) on non-prod environments?

Data protection laws including GDPR state: “Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.” GDPR stipulates data…
Architect
  • 631
  • 1
  • 6
  • 9
1
vote
1 answer

Active Directory GDPR classification

GDPR classifies data into Non-personal, Personal and Sensitive personal. Sensitive personal is further broken down to Genetic and biometric, Racial and ethnical, Religion and Philosophical etc. Coming to implement a new Active Directory I want to…
aquaman
  • 73
  • 5
1
vote
1 answer

Is it ok to assume a user has opted-in to receive emails in an application where the main purpose is sending notifications

I'm working on a web application where the main purpose/functionality is notifying users when there have been changes to regulations in a particular industry. The application is subscription based, i.e. you have to pay for an account and using it is…
Andy
  • 320
  • 1
  • 7
1
vote
1 answer

Deeplinks in email that autologin

I'm wondering if a deep link in an e-mail that automatically authenticate even though the session is expired is GDPR compliant. For instance if I send an e-mail to a user with links to the internal website, containing content available only after…
Tizz
  • 11
  • 2
1
2
3 4