Working from home in this pandemic period? Check some risk associated with it and Follow this step by step checklist that organizations need to take…
By Susan Alexandra, Contributing Writer
EU General Data Protection Regulation (GDPR) imposes strict checks and balances for any mishandling or accidental leakage of personal data. Companies and businesses have to take some mandatory measures to maintain GDPR compliance. The responsibility of the organizations for protecting data turns multifold in the current situation of work from home.
Risks of Working from Home
COVID-19 has forced the corporate industry to opt for remote working in place of an office setting. This has increased the risk of a data breach. The major causes of this increase in risk are:
- Work from home means that several devices are connected to the company’s database. This increases the chances of data theft and leakage.
- The flow of data to and fro the company’s system is carried out through multiple networks with varying security levels. This eases the work of predators and cybercriminals.
- Most of the employees working in a traditional setting are not familiar with the usage of online tools. This increases the chances of human error and the mishandling of data.
- Unprotected devices are always an easy target for phishing emails and malware. Just one risky device or a single random click by any employee can risk the whole system.
Checklist for GDPR Compliance
Here are some necessary measures that your company or organization must take, especially in this current situation of remote working, to maintain their compliance with GDPR.
- The company must update its privacy policy for employees working from home.
- New agreements must be made with third parties and outside vendors to maintain compliance with GDPR.
- All the employees should be provided with secured devices by the company.
- If employees are using their own devices, they must be well protected with an up to date version of antimalware and firewall.
- The encrypted network is a must for data security. Therefore, the company should provide VPN protected Wi-Fi devices to all the employees working from home.
- If the employees are using their own Wi-Fi, they must be restricted to use password-protected Wi-Fi only. They must avoid using shared or public Wi-Fi for accessing and sharing the company’s data.
- Limit access to important files and data.
- Two-factor authentication must be used for allowing access to the company’s database.
- All the tools and software used for communicating and data transfer must be encrypted.
- Employees must be asked to limit their online activities on the devices that are used for accessing the company’s database.
- Employees must be restricted from sharing any details and passwords with unauthorized people. The company’s data should not be shared with anyone, not even with the family members.
- Employees must be trained for the usage of online tools and software to decrease the chances of human error.
- Employees must also be educated about online safety and how to stay safe from phishing emails and invading malware.
- Companies should have a proper IT infrastructure to monitor remote devices connected with their system.
- Notifications must be set to get an alert in case of any security risk from any device connected with the system. This device should be immediately removed from the system and denied access for the time being.
- Companies must have taken Data Processing Impact Assessment (DPIA) to detect any issue in the security system.
- If there are any loopholes in security, they must be dealt with on an urgent basis.
- Companies must have prepared an alternate plan in case of a data breach.
- Employees must also be trained to urgently deal with any security issue at their end.
These are some crucial steps that every organization must take to maintain GDPR compliance and avoid any fines by GDPR. According to a report by PrivacyAffairs, “the total number of GDPR fines are 256 yet”.
Maintaining GDPR compliance has become challenging for organizations in this work from home situation. GDPR is detecting more data breaches than ever and is actively imposing fines on the companies not following a proper data security regime. The time demands companies to be extra vigilant about their data security. They must revise their policies and devise new strategies for safer handling and storage of confidential and crucial data.
About the Author
Susan Alexandra is an independent contributing author at SecurityToday and Tripwire. She is a small business owner, traveler, and investor in cryptocurrencies.
