{"id":74459,"date":"2018-05-24T17:42:28","date_gmt":"2018-05-24T15:42:28","guid":{"rendered":"https:\/\/www.voyages-d-affaires.com\/?p=74459"},"modified":"2018-05-28T09:44:37","modified_gmt":"2018-05-28T07:44:37","slug":"soulis-oppidum-security-rgpd","status":"publish","type":"post","link":"https:\/\/www.voyages-d-affaires.com\/en\/soulis-oppidum-security-rgpd","title":{"rendered":"Interview with Fabien Soulis: Fabien Soulis, Oppidum Security"},"content":{"rendered":"

What does the new RGPD regulation, which comes into force on 25 May, specify?<\/h3>\n

Fabien Soulis -<\/strong> First of all, under the French Data Protection Act (Loi Informatiques et Libert\u00e9s - LIL), personal data is defined as \"any information about an individual or an entity\". any information relating to an identified or identifiable natural person by reference to an identification number or to one or more factors specific to that person<\/em> \". Visit RGPD<\/strong> <\/a>will therefore have a direct impact on the way in which organisations collect, process and store personal data within their information systems. Appropriate technical and organisational measures will therefore need to be put in place to offer the highest possible level of data protection. This is known as the principle of \"privacy by design<\/strong> which is one of the central concepts of the RGPD.<\/p>\n

What methodology should be adopted to incorporate this \"privacy by design\" principle into information systems in order to make them compliant with the RGPD?<\/h3>\n

F. S. - First we need to create a data processing register<\/strong>which is used to document the activities for which you process personal data. Keeping this register is compulsory, as it facilitates the work of an inspector in the event of an audit of the correct application of the RGPD within your organisation. For each activity, you will describe the nature of the activity (e.g. prospect management), the purpose for which the personal data is processed (e.g. organisation of marketing campaigns), the type of people whose data you collect or use (e.g. customers, newsletter subscribers, etc.), the nature of the personal data collected (e.g. customers, newsletter subscribers, etc.) and the purpose for which it is used (e.g. marketing campaigns).), the nature of the personal data collected (e.g. marital status, family situation, etc.), how long the data is kept (e.g. 1 year), who has access to this data (e.g. sales staff, marketing department, IT department, etc.) and lastly the security measures put in place to protect personal data (antivirus, incident monitoring, etc.). At this stage, if you identify that personal data is being kept for no particular purpose, it should be destroyed. Any processing of personal data should help you to pursue an identified objective<\/strong> and approved by the people whose personal data you process.<\/p>\n

Once the list of activities has been documented in the register, what is the second step?<\/h3>\n

F. S. -<\/strong> It is then necessary to ensure that these activities are accompanied by security measures enabling a high level of data protection to be maintained. To achieve this, the RGPD requires organisations processing personal data to carry out a \"data privacy impact assessment<\/strong> (DPIA). The aim of this assessment is to identify the risks generated by data processing in order to determine the appropriate means of reducing them. Carrying out a DPIA requires a good understanding the data lifecycle<\/strong>. To ensure that cyber risks are not overlooked, as they are not always well understood by organisations, it is preferable to call on IT security professionals to assist you.<\/p>\n

mapping personal data<\/p><\/blockquote>\n

How do you set up this assessment?<\/h3>\n

F. S. -<\/strong> The DPIA can be broken down into three stages. To begin with, you need to mapping personal data<\/strong> throughout their life cycle: input, processing, storage, destruction. At each stage of their life cycle, you need to know where personal data is located in your information systems, and who can access it. You will then need to carry out an analysis in order toidentify risks<\/strong> that could have an impact on the confidentiality of this data. This requires an analysis of both organisational and cyber security risks. Finally, knowing the risks to which personal data is exposed, it is necessary to define the resources to be put in place to guarantee a high level of data protection.<\/p>\n

How do you ensure the confidentiality of personal data?<\/h3>\n

F. S. -<\/strong> At the end of each processing register, the legal entity is required to describe the organisational and technical security measures that have been put in place to protect the confidentiality of the data. Data controllers must also describe the control measures they have put in place to protect personal data. The processing register proposed by the CNIL covers six main categories of control:<\/p>\n