Most personal data breaches start with an ordinary act: a click on a fake link, a weak password, an email sent to the wrong person, a laptop left in the car. Security depends on technical measures and on the habits of the people who work.
What the law says
Article 32 of the GDPR requires the controller and the processor to apply technical and organisational measures appropriate to the risk, such as encryption, access control and backups. Article 29 says that anyone working under the authority of the controller processes data only on instructions. A lack of security may be a serious administrative offence (Article 38 of Lei n.º 58/2019).
Passwords and accounts
- Use long and unique passwords for each service. A phrase of several words is worth more than an abbreviation with symbols.
- Never share your credentials, with colleagues or with managers. When people use a shared account, it is no longer known who did what.
- Turn on multi-factor authentication whenever the system offers it.
- Do not write passwords on notes stuck to the monitor.
Phishing and social engineering
Phishing is a fake message that tries to get a person to click, open an attachment or give data. Warning signs:
- urgency or a threat ("the account will be blocked today");
- a strange sender, or an address that looks like the real one but has one letter different;
- a request for passwords, codes or bank details;
- links that lead to an address different from the one shown;
- unexpected attachments.
If you suspect something: do not click, do not open and do not reply. Tell the IT department or the person named in the instructions. If you have already clicked, tell them straight away, even if you are embarrassed. Every hour counts.
The same goes for the telephone or in person: someone who asks for data or access with a plausible excuse (a fake technician, a fake supplier) may be deceiving you. Confirm the identity through a channel you know.
Habits at your workstation
- Lock your screen whenever you leave your workstation. On many systems a key combination is enough.
- Keep a clear desk: do not leave customer or colleague files in view.
- Destroy paper documents that are no longer needed with a shredder, and do not put them in the ordinary bin.
- Mind your screen in public places, such as trains and cafés, and avoid open Wi-Fi networks for work.
- Do not plug unknown USB sticks into the computer. Do not install programs without authorisation.
Sending and sharing information
- Check the recipient before pressing "send". Sending data to the wrong person is a breach of confidentiality and must be reported.
- When writing to many people outside the company, use blind copy (BCC), so as not to expose everyone's addresses.
- Use only the tools approved by the company. Sending work data through a personal account, a private messaging app or an unauthorised artificial intelligence tool may put data outside the employer's control.
- Suppliers that process data for the company are processors, and the relationship must be set out in a contract (Article 28 of the GDPR). Before entering data into a new service, ask.
Equipment
Laptops and phones holding work data should have a code or biometrics, encryption and protection against loss. If one is lost or stolen, tell the employer straight away, because it may be a personal data breach (lesson 7).
Summary: strong, private passwords; care over what you click and who you send to; protected equipment; and a quick warning when something goes wrong.