Most data protection problems come from ordinary mistakes: the wrong recipient, a forgotten computer, weak passwords or a click on the wrong link. Article 32 requires "appropriate technical and organisational measures". What you do every day is part of them.
Passwords and logging in
- Use long, unique passwords. A long sentence is better than a short, complicated word.
- Do not use the same password at work and privately, and never share your password, not even with a colleague or IT support.
- Use a password manager if your employer allows it.
- Turn on multi-factor authentication (for example an app or BankID) wherever it is available.
- Log out or lock the screen (Windows key + L, or Ctrl + Cmd + Q on a Mac) every time you leave the computer.
Clear desk and paper
- Do not leave papers with personal data lying out, on the printer or in meeting rooms.
- Use secure shredding or closed bins for papers with personal data. Do not throw them in the ordinary wastepaper bin.
- Make sure visitors cannot read your screen. Turn it away from windows and customers.
- Keep notes and printouts in a locked cabinet when you leave.
E-mail and messages
- Check the recipient before you send. The name in the address field can be filled in automatically and turn out wrong.
- Use blind copy (BCC) when you e-mail many external people, so that their addresses are not visible to everyone.
- Do not send sensitive data unencrypted. Use the secure service your employer specifies.
- Do not use private e-mail, private cloud services or messaging apps for work tasks unless you have been given permission.
- Do not paste personal data into AI services that your employer has not approved for that purpose. You do not know where the data ends up.
Remote work and travel
- Do not work with personal data on open wifi without a protected connection (VPN) in line with your employer's rules.
- Do not take more data with you than you need. Do not leave a computer or papers in the car or in a bar.
- Do not let family members use the work computer.
USB sticks and private devices
Do not use unknown USB sticks. A stick you find may contain malicious code. Do not save work files on private devices unless this is allowed.
Phishing
Phishing is fraud in which someone pretends to be a bank, a colleague, a manager, a supplier or an authority. The aim is to get you to click a link, open an attachment or type in a password. It can arrive by e-mail, text message, telephone or social media.
Warning signs
- It is urgent or threatening: "Your account will be closed today!"
- The sender's address looks almost right but is not.
- You are asked to log in through a link in the message.
- An unexpected attachment, especially zip files or documents that ask you to "enable content".
- Someone claiming to be your manager asks for an urgent payment or for information.
- The language is unusual or the text is strange.
What to do
- Do not click and do not open any attachments.
- Check the sender in another way, for example by calling a number you already have.
- Report it to IT or the person responsible for security, following your employer's procedure.
- Have you already clicked or typed in a password? Say so at once. The sooner IT knows, the less the damage. You will not be blamed for being honest, but waiting can make the damage much greater.
More about security
The employer must have rules, access rights and technical protection. You must use them. If you find a weakness, for example a door left open or a system that shows too much, say so.