Most personal data breaches are caused by ordinary human error, not by advanced hackers. That is why your behaviour matters most. The security requirement is in Article 32 of the Regulation: the organisation must have suitable technical and organisational measures. You are part of the organisational measures.
Passwords and logging in
- Use long passwords or passphrases. Length matters more than odd characters.
- Use a different password for each service. Reuse means that one leak opens everything.
- Use a password manager that the organisation allows, instead of notes and spreadsheets.
- Turn on multi-factor authentication where it is available.
- Never share passwords, not even with colleagues or IT support. Legitimate support does not ask for your password.
- Never lend out BankID or other electronic IDs.
Screen, desk and printouts
- Lock your screen every time you leave the computer, even for a few minutes.
- Keep a "clean desk": do not leave papers with personal data lying open.
- Make sure that visitors, customers and colleagues without access cannot see your screen, for example at reception or on the train.
- Collect printouts at once and use secure printing if it exists. Shred paper with personal data. Ordinary rubbish is not safe.
Equipment and storage
- Use the organisation's approved systems for personal data. Do not send work files to a private e-mail account, and do not store them on private phones, USB sticks or private cloud services if the rules do not allow it.
- Encrypt portable devices and storage media, and report at once if you lose equipment.
- Do not plug unknown USB sticks into your work computer.
- Keep programs and the operating system up to date. Postponed updates leave known weaknesses open.
- Do not use online artificial intelligence services to process personal data unless the employer has approved it. What you paste in can be stored and used by a third party.
- Check the recipient before you press send. The wrong recipient is one of the most common causes of breaches.
- For mass mailings, use blind copy (BCC) or a mailing tool, so that not everyone sees each other's addresses.
- Do not send sensitive data or national identity numbers in ordinary e-mail. Use encrypted e-mail or a secure messaging service that the organisation has.
- Be careful with attachments: are there hidden sheets, rows or comments in the file that the recipient should not see?
Working from home and travelling
- Use the organisation's VPN and approved equipment.
- Do not let family or guests use the work computer.
- Do not have work conversations about customers and patients in public places where others can hear them.
- On open wireless networks, do not open work systems without a secure connection.
Deletion and disposal
When you dispose of an old computer, phone or disk, the data must be deleted properly. That is the IT department's job, so hand the equipment in to them, not to a rubbish bin.
Do not be afraid to ask
If you are unsure whether something is all right, it is always better to ask beforehand than to clean up afterwards.