Many data leaks are not caused by brilliant hackers but by small everyday slips: a weak password, an email sent to the wrong person or a click on a fake link. Staff are an essential part of security.
The duty of confidentiality
Article 5 of the LOPDGDD says that the controller, the processor and everyone involved in any stage of processing are bound by the duty of confidentiality. That duty continues after the relationship ends with the company. In other words, you will still have to keep the secret when you change jobs.
Article 32 of the GDPR requires the company to apply technical and organisational measures appropriate to the risk. Some depend on management, such as encryption and backups. Others depend on you.
Good habits every day
- Passwords. Use long passwords, different for each service. Do not share them, do not write them on a note stuck to the monitor, and turn on multi-factor authentication if it is available.
- Locked screen. Lock your computer every time you get up.
- Clear desk. Do not leave papers with data in view. Keep documents in locked cabinets and destroy the ones you no longer need in the shredder or in the designated containers.
- Printers. Collect what you print straight away.
- Email. Check the recipient before sending. Use blind copy (BCC) if you write to several people who do not know each other. When you attach sensitive data, use the secure channels your company has indicated.
- Devices. Use only authorised equipment and programs. Do not copy data onto USB sticks or personal cloud storage accounts unless the company allows it.
- Conversations. Do not talk about customers' or colleagues' data in public places, on public transport or in the lift.
- Remote working. Work from a trusted network, not from unprotected public wifi, and stop family members or visitors from seeing your screen.
What phishing is
Phishing is a trick, usually by email, text message or phone call, in which someone pretends to be a bank, a supplier, a colleague or management so that you hand over data or do something. Some signs:
- there is urgency or a threat ("your account will be closed today")
- the sender or the link looks almost right, but has letters changed
- you are asked for a password, a payment or a change of bank account
- there is an attachment or a link you did not expect
If you are suspicious, do not click, do not open the attachment and do not reply. Check through another channel, for example by phoning the person on a number you already know, and tell your company's IT or security manager. Report quickly: if you have already clicked or typed your password, say so immediately. Hiding it makes the damage worse.
Callers asking for data
There are also calls in which someone pretends to be a customer, an agent or a manager. Before you give out data, check their identity and their right to receive it. It is better to take a few minutes than to hand data to someone who should not have it.
Remember: data security is a daily habit. A small slip can have big consequences, and reporting early always helps.