GDPR and Information Security: Are your employees trained to protect data?

When the new data protection law comes into effect on 25th May, one thing won’t change – the need to protect personal data from accidental disclosure. This has long required organisations to train employees on information security, which includes understanding the range of threats and how to avoid them.

Time to assess your data protection culture

Now is of course the perfect time to double down on your efforts, particularly with the greatly increased fine that GDPR introduces for negligence leading to a data breach.

For example, one scenario no organisation wants to experience is an employee being tricked by a phishing email, only to discover that the individual never received any awareness or training on how to spot and avoid phishing. While the debate continues as to whether this on its own would warrant a fine, if combined with other information handling mistakes such as failing to encrypt sensitive information, then the chance of a fine greatly increases. As the maximum penalty will soon be €20 million or 4% of your global turnover, there is significantly greater incentive to minimise the chance of something like this occurring.

Cybercriminals want your personal data

I like to keep my eye on the Information is Beautiful data breaches graphic, which is regularly updated with the world’s biggest information disasters. It’s a good reminder that cybercrime isn’t going away any time soon.

The underlying problem is that personal data about customers, employees and other individuals has value on the black market. Larger companies seem like an obvious target, but many have more money to plough into information security training and awareness, supported by cutting edge security technology. They also tend to have a more organised approach, with a Chief Security Officer and a dedicated team driving the fight back. That doesn’t make them impervious, but it can make a cybercriminal’s job harder.

In this regard, small to medium-sized organisations can be a much easier target. The online world makes it easy to accumulate vast amounts of personal data, yet smaller ventures don’t tend to have the size, structure or budget to field the same sort of approach as a multinational. But having no approach is not an option in today’s world.

The obligation to train

Take phishing for example. This is the use of fraudulent emails, texts and other online messages to trick people into clicking on a website link, opening a file attachment, or disclosing sensitive information in a reply. File attachments can contain malicious software that steals information from the user without their knowledge, whereas phishing websites can trick you into entering your username and password, or infect your device with the same range of malicious software. The messages and websites are disguised to seem genuine, and a targeted phishing attack could even use an email that looks like it comes from someone within your own organisation.

Even the most advanced email filtering technology cannot give you 100% protection from a phishing email landing in the email inbox of one of your employees. The only option is to train employees to recognise what they look like, and know what to do when they see one. For example, you could provide a checklist for assessing whether emails are genuine that includes points such as:

  • Is the sender’s email address suspicious?
    Check whether the email address matches the company or person it is supposed to be from. If you can’t see the address, hover your mouse pointer over the sender’s name.

  • Is the message urgent, mysterious or enticing?
    Cybercriminals want you to act as quickly as possible without thinking, so urgent notifications from your bank, or mysterious file attachments are common tricks. Encouragement to click on a website link or open a file attachment is a strong sign of phishing.

  • Does the email seem unprofessional?
    Phishing emails have become quite sophisticated over recent years, but you can still see the odd clue such as poor spelling, grammar and formatting, and poor-quality graphics.

It’s not all about GDPR

Bear in mind that GDPR is exclusively focused on the way you protect personal data. However, more than likely you have a much wider range of information you don’t want to fall into the wrong hands.

Proprietary information such as ‘secret recipes’ and unique processes must be kept private to protect your competitive advantage. Equally, unpublished financial reports, salaries and internal investigations could invite reputational disaster if they entered the public domain.

Information security must be a vital component of your employee culture, and ignoring it can spell disaster. Over the coming months, it’s worth making sure that your employees understand which types of information need protecting, and how to protect them.

CONTACT JULIE

If you would like more information or advice relating to this article or a Marketing & Business Development matter, please do not hesitate to contact Julie Gingell on 01727 798077.
Read our latest views & insight about the GDPR
Stained glass window
Views & Insight
ICO publishes final version of guidance on consent

Head of employment at SA Law St Albans, Chris Cook, discusses the ICO's guidance on consent

Read More
Stained glass window
Views & Insight
Employers feel unprepared for GDPR deadline

Partner Keely Rushmore comments in People Management on the GDPR and how companies weren't ready for the changes

Read More
Divorce and family law red chair
Views & Insight
EU data is slowing the divorce process

Head of family law at SA Law, Marilyn Bell examines how the GDPR could potentially add more complications to the divorce process

Read More
SA Law Red arrow neon light image
Views & Insight
GDPR affects your mergers & acquisitions too

Acquiring or merging with another organisation means expanding the personal data you hold, whether related to employees, customers, suppliers or other…

Read More
Stained glass window
Views & Insight
GDPR for HR

Solicitor Emma Gross explains why HR professionals should revisit their data protection practices ahead of the GDPR

Read More
SA Law Red arrow neon light image
Views & Insight
GDPR and Information Security: Are your employees trained to protect data?

With just a short while before the General Data Protection Regulation (GDPR) is implemented into UK law, there are many good reasons to check whether…

Read More
SA Law Red arrow neon light image
Views & Insight
What is the difference between ‘data controller’ and ‘data processor’?

It seems fair to say that most organisations are aware that they are subject to obligations under data protection laws and the extent to which they are…

Read More
SA Law Red arrow neon light image
Views & Insight
Charity worker fined for unlawfully obtaining personal data from his employer

Recent case highlights importance of obeying data laws after charity worker fined for misusing personal data.

Read More
GDPR Numbers Image
Views & Insight
GDPR: What should I be doing?

Following a successful run of GDPR compliance events, SA Law's Data & Privacy team share how you can start preparing for the GDPR.

Read More
Green and Red Lights
Views & Insight
GDPR: 12 key changes

Emma Gross explains the 12 key changes to data protection law you need to know.

Read More
Stained glass window
Views & Insight
Information Commissioner demystifies GDPR consent

Head of Employment & Data Chris Cook gives clarity on consent within the GDPR.

Read More
Stained glass window
Views & Insight
How to prepare for the GDPR

The GDPR comes into force on 25th May 2018, but organisations are recommended to start preparing for the changes as soon as possible to avoid non-compliance…

Read More
Views & Insight
ICO issues guidance on preparing for the EU General Data Protection Regulations (GDPR)

As many organisations will be aware, the existing EU data protection provisions are due to be reformed by the GDPR which is expected to receive formal…

Read More
Views & Insight
What every business needs to know about The General Data Protection Regulation

Legislative bodies in Europe have agreed radical reforms to European Union data protection guidelines but it will take time, money and careful planning…

Read More
Stained glass window
Views & Insight
ICO prosecutes company employees for unlawfully accessing client data

A former employee of Lex Autolease Ltd has been prosecuted and fined under section 55 of the Data Protection Act 1998.

Read More
Stained glass window
Views & Insight
ICO issues record £400,000 monetary penalty notice for TalkTalk data breach

The Information Commissioner has issued a record £400,000 monetary penalty notice to TalkTalk Telecom Group plc for failing to keep personal data secure.

Read More
Stained glass window
Views & Insight
Government introducing personal liability for directors for nuisance call fines

Amendments to the Privacy and Electronic Communications Regulations 2003, announced and to be introduced in spring 2017.

Read More
Stained glass window
Views & Insight
Government officially confirms adoption of the GDPR

On appearing before the Culture, Media and Sports Select Committee on 24 October 2016, the Secretary of State Karen Bradley MP, confirmed that the UK…

Read More
Stained glass window
Views & Insight
Departing employee convicted of taking client records before joining rival firm

Employees risk both criminal prosecution and civil action for unlawful use of information belonging to employers.

Read More
Intellectual Property, fonts
GDPR Assist
GDPR Definitions & Who's Who

Helping you get up to speed with everything GDPR

Read More
GDPR Numbers Image
Views & Insight
Fill in the details

Head of Employment and Data Chris Cook examines the importance of staff training when it comes to payroll and the looming GDPR.

Read More
SA Law commuters on London Bridge
Views & Insight
Data Protection Bill under challenge

Gemma Jones, Head of Immigration, explains the immigration exemptions within the upcoming GDPR

Read More
SA Law Red arrow neon light image
Views & Insight
GDPR and Information Security: Are your employees trained to protect data?

With just a short while before the General Data Protection Regulation (GDPR) is implemented into UK law, there are many good reasons to check whether…

Read More
Banner image red car light moving
Views & Insight
Draft Data Protection (Charges and Information) Regulations 2018 and guide published

The draft regulations are of course, subject to Parliamentary approval but, given that there is limited time until the GDPR, they are unlikely to change.

Read More

© SA LAW 2018

Every care is taken in the preparation of our articles. However, no responsibility can be accepted to any person who acts on the basis of information contained in them alone. You are recommended to obtain specific advice in respect of individual cases.