You should put adequate entrance protections in place including doors and locks, and protect premises with alarms, security lighting, or CCTV video surveillance. You should also control access within the premises and supervise visitors. Servers should be located in a separate room and protected by additional controls.

All staff must lock away paper records and mobile computing devices when not in use. Additionally, staff should be encouraged to promptly collect documents from printers, fax machines, and photocopiers and turn off devices outside working hours. Preferably, secure document printing should be implemented.

All staff must securely dispose of paper data using a document shredder. If you use third-party services to wipe data and dispose of or recycle computers, you must ensure they do so adequately. You could be held liable if personal data you collected is extracted from your old equipment and resold.

It is important to actively manage all hardware and software used by the company. You should identify and describe all office or home equipment, servers, and mobile devices that are being used to process or store personal data in an appropriate hardware inventory or register. The asset inventory should also include information on whether the device is a portable or personal device. Similarly, you should also identify and describe all systems and applications that process or store personal data in an appropriate software register that includes details on software licensing, the latest versions deployed, and any patches applied.

Then, for each of the identified assets, you must assign asset ownership and establish the security category.

You should identify, describe, and enforce rules for the acceptable use of hardware or software, systems, or applications that process or store data.

These inventories will help you create whitelists of approved devices, applications, and software. You should also perform regular risk assessments of the hardware and software asset inventories, or registers, and physical checks to ensure the accuracy of the hardware asset inventory.

You must have procedures in place to ensure that all employees (permanent and temporary staff) and third-party personnel return hardware assets at the end of their employment, contract, or agreement.

Mobile working can result in personal data being stored and in transit outside the secure boundaries of your business. Mobile devices, such as laptops, notebooks, tablets, and smartphones are vulnerable to theft and loss, and there are confidentiality risks when using devices in public places.

You should therefore assess the risks of mobile working, including remote working where mobile devices may connect to the corporate network, and develop a policy setting out the rules for authorizing and managing mobile and home working.

The default installation of ICT equipment can include vulnerabilities such as unnecessary guest or administrative accounts, default passwords well-known to attackers, and pre-installed but unnecessary software. These vulnerabilities can provide attackers with the opportunity to gain unauthorized access to personal data held on corporate systems.

You should securely configure ICT equipment upon installation. Maintaining an inventory of ICT equipment will help you identify and remove unnecessary or unauthorized hardware and software.

Removable media, e.g. CDs, DVDs, USB drives, smartphones, are highly vulnerable to theft or loss, and uncontrolled use can lead to data breaches.

If you must store personal data on removable media, you should use a software solution that can set permissions or restrictions for both individual devices and entire categories.

You should minimize and encrypt personal data.

Management should authorize access to systems containing personal data and limit user permissions to the absolute minimum, known as least privilege. You should assign each user their own username and password to ensure their accountability.

User login credentials, such as username and password, are particularly valuable to attackers. A brute force password attack is a common threat, so you need to enforce strong passwords and limit the number of failed login attempts.

You should actively facilitate and encourage staff to choose a strong password.

You also need to verify user activity to detect any abnormal use.

Having multiple passwords for different systems can be difficult for staff to remember, however it is important that passwords are not written down or recorded in accessible locations or systems.

You should promptly disable passwords when staff change service or leave the business.

Computers can be infected with malware, e.g. viruses, worms, trojans, spyware, via email attachments, websites, and removable media. This can result in the loss or corruption of personal data.

You should install anti-malware protection software that regularly scans your network and computers to detect and prevent threats. You must keep the software updated and educate staff about common threats.

You should perform regular backups to restore personal data in the event of incidents or hardware failures. The extent and frequency of backups should reflect the sensitivity and confidentiality of the personal data and how crucial it is to your business operations. As a rule, it is advisable to keep backups in a secure location away from the company premises and periodically test the recovery of personal data to verify its effectiveness.

Monitoring and logging can help your company detect and respond to external threats and any inappropriate use of information resources by staff.

You should continuously monitor inbound and outbound network traffic to identify unusual activity, e.g. massive transfers of personal data, or trends that could indicate an attack. Your systems should be able to log who has accessed resources containing personal data so that regular monitoring can be performed to ensure that only authorized staff members have accessed the information.

Monitoring and logging must comply with all legal and regulatory constraints, including data protection legislation. For example, you should inform staff of any monitoring actions taken against them.

Popular software products contain technical vulnerabilities that can be exploited by attackers to gain unauthorized access to personal data held on your systems.

You should use the latest versions of operating systems, web browsers, and applications and ensure you update them regularly to prevent the exploitation of unpatched vulnerabilities.

Attackers can gain unauthorized access to personal data if you don't secure the boundary between your computer network and the internet.

You should install a firewall to monitor and restrict network traffic based on an established set of rules. A well-configured firewall is your first line of defence against external attacks and can help prevent data breaches, for example by blocking malware or hacking attempts.

You must also minimize the impact of data breaches by segmenting and restricting access to network components that contain personal data. For example, the web server must be separated from the main server. If your website is compromised, the attacker will not have direct access to the central data repository.

The GDPR introduces a requirement for all organisations to report certain types of personal data breaches to the Data Protection Authority and, in some cases, to the data subjects.

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.

Personal data breaches can result from theft, an attack on your systems, unauthorized use of personal data by a staff member, or accidental loss or equipment failure.

You must ensure your staff understands what constitutes a personal data breach and that it is much more than just losing personal data.

You must ensure you have an internal breach reporting procedure in place. This will facilitate decision-making regarding the need to notify the Data Protection Authority or data subjects.

You must notify a personal data breach to the Data Protection Authority unless it is unlikely to result in a risk to the rights and freedoms of data subjects.

If not properly addressed, such a breach is likely to have a significant detrimental effect on individuals. For example discrimination, reputational damage, financial loss, loss of confidentiality, or any other significant economic or social disadvantage.

You must evaluate this on a case-by-case basis. For example, while you need to notify the Authority about a loss of customer data if the breach leaves individuals exposed to identity theft, the inappropriate loss or alteration of a staff telephone directory does not normally require such action.

The breach notification must contain:

• a description of the nature of the personal data breach including, where possible
• the categories and approximate number of data subjects concerned
• the categories and approximate number of personal data records concerned
• the name and contact details of the data protection officer (if the organisation has one) or other contact point where more information can be obtained
• a description of the likely consequences of the personal data breach
• a description of the measures taken or proposed to be taken to address the personal data breach and, where appropriate, measures to mitigate its possible adverse effects

You must report a breach to the Authority without undue delay, not later than 72 hours after having become aware of it. If you take longer, you must justify the delay. It may not always be possible to fully investigate a breach within that timeframe, and therefore information can be provided in phases.

Where a breach is likely to result in a high risk to the rights and freedoms of the individuals involved, you must inform the data subjects directly and without undue delay.

You must describe, in clear and plain language, the nature of the personal data breach and at least:

• the name and contact details of the data protection officer (if the organisation has one) or other contact point where more information can be obtained
• a description of the likely consequences of the personal data breach
• a description of the measures taken or proposed to be taken to address the personal data breach and, where appropriate, measures to mitigate its possible adverse effects

Even if a breach does not need to be reported, you must still keep a record of it, including its details, its effects and the remedial action taken. This is part of your overall obligation to comply with the accountability principle and allows the compliance of your organisation with the notification obligations under the GDPR to be verified.

However a breach occurs, it is important to deal with it effectively and learn from it for the future. You must have a procedure in place to investigate what happened and implement recovery plans.

If possible, you should track the type, volume, and cost of incidents to identify trends and help prevent recurrences.