Article 32 requires the company and its processors to ensure an appropriate level of security. Most personal data breaches do not happen through advanced attacks, but through ordinary mistakes. Here are the habits that make the most difference.
Access and passwords
- Use long and unique passwords. A long sentence is better than a short, complicated word. Never use the same password for work and private accounts.
- Use a password manager if the company offers one.
- Switch on multi-factor authentication wherever possible. Never share your codes, not even with colleagues or IT.
- Lock your screen when you leave your seat.
- You may open only information you need for your work. Looking up a celebrity or a colleague out of curiosity is not work, and it can be an infringement.
- Check the recipient before you press send. Autocomplete easily picks the wrong person with the same first name.
- When you send to many people who do not know each other, use BCC. Otherwise you share everyone's email addresses.
- Confidential and sensitive information should, as a starting point, be encrypted when sent by email over the internet. That is Datatilsynet's assessment of what is appropriate security. Use the secure email solution the company has chosen.
- Do not write personal data in the subject line.
Paper, devices and working from home
- Keep a tidy desk. Put papers with personal data in a closed drawer.
- Use the company's shredder or locked waste bin, not the ordinary wastepaper bin.
- Do not store information on private devices, USB sticks or private cloud services unless the company has allowed it.
- Do not use external AI tools, and do not copy customer or employee information into them, unless the company has approved the tool for that purpose. What you type in often leaves the company.
- At home: use a secure connection, do not let family see the screen, and do not leave the device unlocked in the car or at the café.
- Do not talk loudly about customers or patients, for example on the train.
Phishing
Phishing is fake emails, text messages or calls meant to make you give out information, click a link or pay. Typical signs:
- time pressure ("the account will be closed today") or threats
- a sender who looks like someone you know but has a slightly different address
- a link whose address does not match the sender
- attachments you were not expecting
- a "boss" who suddenly wants a quick payment or gift cards, or a colleague who asks for your codes
What you do:
- Do not click, do not open, and do not reply.
- Check through another channel. Call the sender on a number you know.
- Report the email to your IT or security contact. If you have already clicked or entered anything, tell them straight away. Reporting quickly can limit the damage.
Styrelsen for Samfundssikkerhed (the Danish agency for civil protection and societal security, formerly the Centre for Cyber Security) has advice on phishing at samsik.dk.
Updates and unknown programs
Install security updates when your IT department asks you to. Many attacks exploit flaws for which an update has existed for a long time. Do not install programs, apps or extensions on your own, and do not plug in unknown USB sticks. If something looks strange on your computer, report it before you try to fix it yourself.
Speak up without feeling ashamed
Anyone can be tricked. The worst thing is to stay silent. The company can step in only if it hears about the mistake in time.