Use GDPR to propel business forward, says ICO

CIA triad model of security

Underlining the link between privacy and cyber security, Houlden said confidentiality, integrity and availability (CIA) triad model of security can be applied in the context of the GDPR.

In terms of confidentiality, organisations need to ensure personal data is secure in transit and at rest, he said. “Even if it is lost or hacked, it should not be readable,” he added.

When it comes to integrity, organisations need to ensure that personal data is accurate, complete, up to date, and kept only as long as necessary.

In terms of availability, organisations need to ensure personal information can be accessed when needed, and understand how individuals and their rights could be affected if it is not.

“Availability could be affected by ransomware and loss of passwords or encryption keys, which regulators will be looking at because they are breaches of the GDPR,” he said.

The core expectations of the GDPR, said Houlden, are aligned to the top level security objectives of managing security risk, protecting against cyber attack and detecting security events.

With just one week to go before the GDPR compliance deadline, he said organisations should ensure they are taking action in all these areas and that they are documenting what they are doing.

Emphasising that the ICO prefers to focus on education, support and guidance rather than punish organisations through enforcement action, he said the ICO will take into account anything organisations can show to demonstrate that they were taking their responsibilities under the GDPR seriously.

“If the worst happens, data privacy impact assessments and other documentation will be taken into account,” he said, urging organisations to keep records of all they are doing so that ICO investigators can give credit where credit is due.

Those organisations that engage with the ICO to resolve issues can demonstrate strong information rights accountability arrangements and are trying their best to respect people’s privacy, said Houlden, can expect the ICO to take that into account when considering any action the regulator may need to take.

“And it all comes down to cyber security, which has a huge part to play in the digital world and the digital economy. If cyber security is not right, you are then just relying on your policies, which relies on humans. You need that cyber security layer to be solid. It needs to be functioning as it should do,” he said.

Houlden assured UK organisations that the ICO is going to be proportionate and pragmatic and is not on a mission to punish organisations after the GDPR compliance deadline.

“This is about people and their rights, and cyber security professionals can protect that, and that is what you need to tell company boards. You need to tell them that your talent can help protect citizens’ rights, which is what the GDPR is all about,” he added.