| | JUNE 202219ENSURING PROTECTION WITH APPROPRIATE TECHNICAL AND ORGANIZATIONAL MEASURES By James Lloyd, Partner, Latham & WatkinsWhat's "appropriate"?The requirement to process personal data securely is a key principle of the GDPR. In order to meet this obligation to secure data, the GDPR says that organizations must use "appropriate technical and organizational measures" to protect personal data. Technical and organizational measures are the physical and digital processes, procedures, or controls put in place to protect personal data both at rest and in transit, and also to detect when those measures have been compromised. This can include policies for governing what employees can and cannot do with personal data, policy monitoring, responsibilities around safe digital practice, access controls, firewalls, incident and event logging, and monitoring technologies. So far, so simple. But, when you dig into the details, things get a little complicated. While the broad language in the GDPR gives some flexibility to account for different risks, which may present themselves due to the uniqueness of data processing in any given organization, determining whether the technical and organizational measures taken are "appropriate" is difficult. If something does ultimately go wrong and the appropriate supervisory authority subsequently subjects your business to an audit or an investigation, their idea of what would have been considered "appropriate" may be very different to yours. For example, what constitutes "state of the art" when it comes to security? And, in the case of a data breach, you may end up with a regulator demonstrating the benefit of hindsight by (perhaps unfairly) assuming that something--your selection of controls, for instance--must not have been appropriate to preventa breach that occurred. So, what can you do to mitigate the risk?When implementing controls for your organization, it is important to take a risk-based approach to protect data and to mitigate risks associated with areas such as:1. Data Type- You should assess the types of data held and attribute risk ratings depending on the sensitivity of the data, the potential risks, and freedoms of data subjects.2. Data Source- You need to assess whether there are any risks associated with the collection of the data or the method of the collection. For example, if you are collecting personal data through your website, you must apply security measures on the website to protect the data while it is being collected.3. Data Storage- You should assess every risk associated with data storage and apply controls based on the method of storage Technical and organizational measures are the physical and digital processes, procedures, or controls put in place to protect personal data both at rest and in transit, and also to detect when those measures have been compromisedCXO INSIGHTS
< Page 9 | Page 11 >