Prepare for GDPR

What you need to do before May 2018

In May 2018, the General Data Protection Regulation (GDPR) comes into effect. It is a regulation introduced by the European Commission in order to strengthen EU citizens’ rights to protection of personal data. The GDPR affects all companies who collect and use personal data of EU individuals— regardless of whether the company itself is located in the EU. Critical to compliance is to prevent unauthorized access to sensitive information and audit and monitor all user activity — which are key functionalities of Safewhere’s Identity and Access Management platform. We can help you achieve compliance with important requirements of the GDPR.

Potential fines for noncompliance as high as 4% of your annual global revenue is an important argument for why you need to make GDPR compliance a top priority, but showing that you are able to create trusted relationships with partners, customers, and citizens is also a great opportunity for your company to differentiate itself.

What are the key changes?

Privacy by design and privacy by default

In short, privacy by design means that any new service or process must take protection of personal data into consideration. This requires companies to take privacy into account from the very beginning of any project, and protect personal data throughout its entire life cycle.
Privacy by default means that wherever possible, the collection of personal data must be limited to what is necessary for the specified purposes.

Right to be forgotten

EU individuals have the right to demand that their personal data is deleted if it is no longer necessary to the purpose for which it was collected. This is known as the “right to be forgotten”. Under this rule, they can also demand that their data is erased if they have withdrawn their consent for their data to be collected, or object to the way it is being processed.

Breach notification

One of the key new changes under the GDPR is the right of EU individuals to be notified if their data has been breached or compromised and that data poses “a high risk to their rights and freedoms.” Companies are also required to notify data protection authorities within 72 hours of a breach occurring. This will be a huge challenge to many companies as at present the average breach takes over 200 days to detect.

What data is regulated?

The GDPR regulates collection, processing, and storage of personal data of EU individuals.
The GDPR expands the definition of personal data substantially, so that it now includes any information that can be connected to a specific EU individual. This can be anything from a name, a photo, or an e-mail address to less obvious information, such as a computer’s IP address, medical information, and location data.

What you need to do

GDPR compliance will require comprehensive changes to your policies, processes and maybe even systems.

Data classification

You have to know where personal data is stored on your systems. Don’t forget data stored in unstructured formats in documents, presentations, and spreadsheets. This is critical for both protecting the data and following through on requests to correct and erase personal data.

Meta data

With GDPR requirements for limiting data collection, you will need to store basic information on when the data was collected, why it was collected, and for what purpose. Personal data residing in your IT systems should be reviewed periodically to see whether it needs to be saved for the future or deleted.

Data governance

With privacy by design and by default, you should focus on data governance basics. For both structured and unstructured data, this should include understanding who is accessing personal data in your systems, who should be authorized to access, and limiting the permissions based on the employee’s actual role(s), that is, role-based access control.

Monitoring

The breach notification requirement places a new burden on data controllers. Under the GDRP, the IT security mantra should be always monitor. You need to be able to spot unusual access patterns against systems containing personal data and to report an exposure to the local data authority.

How we can help you

One identity

To help you control who is accessing what personal data, with Safewhere’s platform, you can allow users to sign in with a domain account such as Active Directory, while you can let all external user groups—suppliers, partners, customers, citizens—sign in with their own authentication method to your on-premises and cloud applications. This will help you comply with articles 25, 30, and 32 of the GDPR.

Adaptive authentication

To improve access security, Safewhere also enables you to request users to sign in with one or more additional authentication factors (multifactor authentication) based on the data classification of the application they are trying to access and the users’ location. This can be multifactor authentication through e-mail or SMS or using a third-party solution such as Yubico, Google Authenticator, or Gemalto. Due to the flexible architecture of the Safewhere platform, any MFA solution can be used. This will help you comply with articles 25,30, and 32 of the GDPR. Learn more about our platform’s multi-factor authentication and adaptive authentication features.

Access governance

With our user provisioning functionality, you can control what users have access to: which applications and what data. When a new employee joins your organization, user provisioning helps you make sure that he or she has the correct access rights to the applications needed. When that employee leaves the organization, all access rights will be immediately revoked and the user account will be disabled. The Safewhere platform provides a complete, real-time view of what users have access to and which applications. This will help you ensure compliance with articles 25,30, and 35 of the GDPR.

Monitoring and audit

Using our extensive logging, you can monitor in real time on which users are accessing what applications. Due to the flexible architecture of the platform, any monitoring system can be used. When you have been subjected to a data breach, you can use the logging features to generate an audit report of who accessed what application at any given time and location. This will help you comply with articles 30 and 33 of the GDPR.

 mv,,b,bvm,mvm,

The GDPR and Identity and
Access Management

Some recommendations from an Identity
and Access Management point of view on
how to prepare for GDPR compliance

Read more on the blog >

jffkj

Learn more about our GDPR compliance solutions 

We use cookies to collect statistical information in order to improve the website and user experience to match the needs of the majority. You can always delete the saved cookies in your browser settings.
Cookies settings
Accept
Privacy & Cookie policy
Privacy & Cookies policy
Cookie name Active

Privacy Policy

What information do we collect?

We collect information from you when you register on our site or place an order. When ordering or registering on our site, as appropriate, you may be asked to enter your: name, e-mail address or mailing address.

What do we use your information for?

Any of the information we collect from you may be used in one of the following ways: To personalize your experience (your information helps us to better respond to your individual needs) To improve our website (we continually strive to improve our website offerings based on the information and feedback we receive from you) To improve customer service (your information helps us to more effectively respond to your customer service requests and support needs) To process transactions Your information, whether public or private, will not be sold, exchanged, transferred, or given to any other company for any reason whatsoever, without your consent, other than for the express purpose of delivering the purchased product or service requested. To administer a contest, promotion, survey or other site feature To send periodic emails The email address you provide for order processing, will only be used to send you information and updates pertaining to your order.

How do we protect your information?

We implement a variety of security measures to maintain the safety of your personal information when you place an order or enter, submit, or access your personal information. We offer the use of a secure server. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our Payment gateway providers database only to be accessible by those authorized with special access rights to such systems, and are required to?keep the information confidential. After a transaction, your private information (credit cards, social security numbers, financials, etc.) will not be kept on file for more than 60 days.

Do we use cookies?

Yes (Cookies are small files that a site or its service provider transfers to your computers hard drive through your Web browser (if you allow) that enables the sites or service providers systems to recognize your browser and capture and remember certain information We use cookies to help us remember and process the items in your shopping cart, understand and save your preferences for future visits, keep track of advertisements and compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future. We may contract with third-party service providers to assist us in better understanding our site visitors. These service providers are not permitted to use the information collected on our behalf except to help us conduct and improve our business. If you prefer, you can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies via your browser settings. Like most websites, if you turn your cookies off, some of our services may not function properly. However, you can still place orders by contacting customer service. Google Analytics We use Google Analytics on our sites for anonymous reporting of site usage and for advertising on the site. If you would like to opt-out of Google Analytics monitoring your behaviour on our sites please use this link (https://tools.google.com/dlpage/gaoptout/)

Do we disclose any information to outside parties?

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information. This does not include trusted third parties who assist us in operating our website, conducting our business, or servicing you, so long as those parties agree to keep this information confidential. We may also release your information when we believe release is appropriate to comply with the law, enforce our site policies, or protect ours or others rights, property, or safety. However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.

Registration

The minimum information we need to register you is your name, email address and a password. We will ask you more questions for different services, including sales promotions. Unless we say otherwise, you have to answer all the registration questions. We may also ask some other, voluntary questions during registration for certain services (for example, professional networks) so we can gain a clearer understanding of who you are. This also allows us to personalise services for you. To assist us in our marketing, in addition to the data that you provide to us if you register, we may also obtain data from trusted third parties to help us understand what you might be interested in. This ‘profiling’ information is produced from a variety of sources, including publicly available data (such as the electoral roll) or from sources such as surveys and polls where you have given your permission for your data to be shared. You can choose not to have such data shared with the Guardian from these sources by logging into your account and changing the settings in the privacy section. After you have registered, and with your permission, we may send you emails we think may interest you. Newsletters may be personalised based on what you have been reading on theguardian.com. At any time you can decide not to receive these emails and will be able to ‘unsubscribe’. Logging in using social networking credentials If you log-in to our sites using a Facebook log-in, you are granting permission to Facebook to share your user details with us. This will include your name, email address, date of birth and location which will then be used to form a Guardian identity. You can also use your picture from Facebook as part of your profile. This will also allow us and Facebook to share your, networks, user ID and any other information you choose to share according to your Facebook account settings. If you remove the Guardian app from your Facebook settings, we will no longer have access to this information. If you log-in to our sites using a Google log-in, you grant permission to Google to share your user details with us. This will include your name, email address, date of birth, sex and location which we will then use to form a Guardian identity. You may use your picture from Google as part of your profile. This also allows us to share your networks, user ID and any other information you choose to share according to your Google account settings. If you remove the Guardian from your Google settings, we will no longer have access to this information. If you log-in to our sites using a twitter log-in, we receive your avatar (the small picture that appears next to your tweets) and twitter username.

Children’s Online Privacy Protection Act Compliance

We are in compliance with the requirements of COPPA (Childrens Online Privacy Protection Act), we do not collect any information from anyone under 13 years of age. Our website, products and services are all directed to people who are at least 13 years old or older.

Updating your personal information

We offer a ‘My details’ page (also known as Dashboard), where you can update your personal information at any time, and change your marketing preferences. You can get to this page from most pages on the site – simply click on the ‘My details’ link at the top of the screen when you are signed in.

Online Privacy Policy Only

This online privacy policy applies only to information collected through our website and not to information collected offline.

Your Consent

By using our site, you consent to our privacy policy.

Changes to our Privacy Policy

If we decide to change our privacy policy, we will post those changes on this page.
Save settings
Cookies settings