Article 32 GDPR requires the controller to take technical and organisational measures appropriate to the risk. The best of them are useless if an employee bypasses them. Most data leaks do not come from an attack on a perfect system but from human error.
Passwords and logging in
- Use long and unique passwords. A sentence is better than a short word with special characters. Do not use the same password for several services.
- Turn on multi-factor authentication wherever it is available.
- Do not share your password, not even with a colleague or a supervisor. Do not write it on a note under the keyboard.
- Lock your computer when you leave it (on Windows, press Win + L).
- Store passwords in the company's password manager, if the company uses one.
Phishing and fraudulent messages
Phishing is a fraudulent message meant to make you give away data, click a malicious link or open an attachment. There is also a version by phone and SMS. You can recognise it like this:
- it is urgent ("immediately", "your account will be blocked")
- the sender's address only resembles the real one
- it contains an unexpected attachment or link
- it asks for a password, a code or a payment to a new account
- it is addressed generally, "Dear customer"
What to do: do not click, do not log in through the link, verify the message through another channel (by phone, on a number you know) and report it according to company rules, preferably to the IT or security department.
Working remotely and away from the office
- Do not work with data on public unsecured Wi-Fi without the secure connection (VPN) that the company has designated.
- Lock the device when you step away from it. In public, make sure nobody can see your screen.
- Do not save work data to a private cloud or send it to a private e-mail.
- Do not lend work devices to your family.
Paper and space
- Do not leave documents with personal data on a desk, in the printer or on the copier. Lock them away at the end of work.
- Shred documents you no longer need; do not throw them in the ordinary bin.
- When talking about personal matters, consider who can hear you.
E-mail, sharing and attachments
- Before sending, check the recipient. A wrongly addressed e-mail is the most common data leak.
- For a mass message to people outside your colleagues, use blind copy (BCC) so that recipients do not see each other's addresses.
- Protect sensitive attachments with a password and send the password through a different channel.
- Share by a link with restricted access, not a public one.
Devices and data carriers
Do not plug unknown USB drives into your computer. Report immediately the loss of a phone, laptop or drive with company data. Quick reporting makes it possible to lock or wipe the device remotely.
Pseudonymisation and encryption
Encryption means that nobody can read the data without the key. Article 32 GDPR expressly names pseudonymisation and encryption as possible measures. If a device is encrypted and gets lost, the risk to people is usually much lower.
What to remember
- A password is personal. Do not share it and use multi-factor authentication.
- You recognise phishing by urgency, a strange sender and a call to act.
- Lock documents, shred them and check the recipient before sending.
- Report the loss of a device or a suspected leak immediately.
When something goes wrong
A mistake can happen to anyone. You send an e-mail to the wrong recipient, click a link in a fraudulent message or open an attachment you were not sure about. Never hide it. Tell your supervisor or IT immediately. Reporting early makes it possible to stop the damage and meet the legal deadlines described in the next lesson.