{"id":7415,"date":"2022-04-08T08:09:52","date_gmt":"2022-04-08T06:09:52","guid":{"rendered":"https:\/\/www.actonic.de\/fallstricke-beim-datenschutz\/"},"modified":"2023-03-23T08:45:32","modified_gmt":"2023-03-23T07:45:32","slug":"data-security-pitfalls","status":"publish","type":"post","link":"https:\/\/actonic.de\/en\/data-security-pitfalls\/","title":{"rendered":"The most common data security pitfalls \u2013 and how to avoid them"},"content":{"rendered":"

[vc_row][vc_column][vc_column_text]<\/p>\n

After all, in a study by Aikami, <\/a>66% of all Internet users say they support privacy policy regulations policies <\/span>like GDPR<\/strong> and would like to see more similar laws.<\/p>\n

So complying with all privacy policies saves both your wallet and your image. Unfortunately, data breaches often happen unintentionally when people are unaware of the most common data security pitfalls.<\/p>\n

That’s why we’re here to clear things up and<\/span> give you tips on how to avoid the most common pitfalls!<\/p>\n

Not updating data privacy information<\/h2>\n

You know about the obligation to provide information under the GDPR and, of course, you have obtained all consents when collecting data for the first time. But have you also thought about the need to adapt the data protection information? Data protection information changes<\/strong> more often than you might think. As soon as new IT systems are set up or new processing activities are carried out, the data security information must also be renewed. All data subjects must be informed of the update \u2013 even those who have already accepted previous notifications.<\/p>\n

[\/vc_column_text][vc_column_text el_class=”info-box-general-twolines”]Solution:<\/span><\/strong> Find a wa<\/span>y to view current changes and communicate them transparently.[\/vc_column_text][vc_column_text]<\/p>\n

Forgot your records of processing activities<\/h2>\n

According to Article 30 of the GDPR,<\/a> you must list all your processing activities, including which data is transferred to whom and for what purpose. The date of deletion must also be recorded. Your company has less than 250 employees? Then you don’t have to keep a processing register, right?<\/p>\n

Wrong.<\/span><\/p>\n

Please put this myth out of your mind. A processing directory does not depend on the size of a company. It only doesn’t apply if no risks arise from data processing. However, risks always arise.<\/p>\n

[\/vc_column_text][vc_column_text el_class=”info-box-general-oneline”]Solution: <\/strong>Please maintain records of processing activities carefully.[\/vc_column_text][vc_column_text]<\/p>\n

Hoarding dead documents<\/h2>\n

“I just print out the processing directory, put it in the data protection documents folder and store everything in the basement. Duty fulfilled,” said no responsible data protection officer ever.<\/p>\n

Because it is important to keep all data up to date, also with this pitfall. Don’t rely on analog paperwork, whose transparency only a few pe<\/span>ople can comprehend.<\/p>\n

[\/vc_column_text][vc_column_text el_class=”info-box-general”]Solution: <\/strong>Digital tables, for example, can be kept up-to-date in Confluence <\/a>with little effort. Get Inline Table Editing <\/strong><\/a>and you will experience Confluence tables in Excel style![\/vc_column_text][vc_column_text]<\/p>\n

Use templates from providers<\/h2>\n

Unfortunately, many companies lack the<\/span> time or motivation to deal sufficiently with data protection. To save resources, they rely on templates from various providers. However, these are often not specifically customized for your company, <\/strong>and so it can quickly happen that you forget some important details. For example, you also need to document when recorded working times and application documents are deleted.<\/p>\n

[\/vc_column_text][vc_column_text el_class=”info-box-general-twolines”]Solution: <\/strong>So rather leave the processing activities small-scale and work carefully![\/vc_column_text][vc_column_text]<\/p>\n

Not objecting is far from consenting<\/h2>\n

Verbal consents to data processing are not effective. Without written consent that is fully and transparently documented, the basis for data processing according to <\/span>GDPR is missing. So be aware of when and for which topics you need consent and get the consent written. <\/strong>Watch out. Effectively given consents can be forfeited.<\/p>\n

[\/vc_column_text][vc_column_text el_class=”info-box-general-twolines”]Solution: <\/strong>The best thing to do is to have a tool at hand to view the current statistics on consent.<\/span>[\/vc_column_text][vc_column_text]<\/p>\n

Designate an alibi<\/span> Data Protection Officer<\/h2>\n

In some cases, you may need to designate a data protection officer. Due to time constraints, it is common to simply nominate a person so that the issue is off the table. But take this matter seriously! Data protection officers should be competent and reliable. In addition, there must be no conflicts of interest.<\/strong> Consequently, it does no good if you also want to appoint your external IT service provider as external data protection officer. After all, you cannot monitor yourself.<\/p>\n

[\/vc_column_text][vc_column_text el_class=”info-box-general-twolines”]Solution: <\/strong>Don’t try to trick the supervisory authority. Take the issue seriously.[\/vc_column_text][vc_column_text]<\/p>\n

See data security as your enemy<\/h2>\n

You are an agile company with thousands of brilliant ideas, and of course you want to implement them all. But it often happens that a company’s data protection officer puts supposed obstacles in your way. This and that cannot be implemented for data security reasons. You need consent for every photo. So cumbersome!<\/p>\n

In such situations, please remember the study quoted at the beginning: Most people are grateful that the GDPR exists. <\/strong>You personally certainly don’t want your sensitive data to be freely accessible, either. Therefore, it is also important that you raise the awareness of the employees in your company for the topic of data security. As a team leader or even CEO, you should set an example and live a positive data protection culture. Your data protection officer is not a buzz kill,<\/span> but wants to protect you from penalties and unflattering headlines.<\/p>\n

[\/vc_column_text][vc_column_text el_class=”info-box-general”]Solution: <\/strong>See the positive in the GDPR! If that doesn’t help, maybe a deterrent example? The prize for the highest 2021 GDPR fine<\/strong> goes to Amazon. The company had to pay no less than 746 million euros<\/a>.[\/vc_column_text][vc_column_text]<\/p>\n

Outsourcing what\u2019s possible<\/h2>\n

In principle, there is nothing to be said against outsourcing data privacy matters. In many cases, this is even more effective than an in-house solution. Nevertheless, as soon as activities are outsourced, an order processing contract must be drawn up with all details such as technical organizational measures. Sounds daunting, but our article about order processing according to GDPR article 28 <\/a>will take away your fear.<\/p>\n

[\/vc_column_text][vc_column_text el_class=”info-box-general-twolines”]Solution: <\/strong>Carefully create an order processing contract <\/span>and a data processing agreement (DPA) \u2013 also with the help of apps.[\/vc_column_text][vc_column_text]<\/p>\n

Wanting to keep data security breaches quiet<\/h2>\n

Mistakes can happen. And yes, it’s embarrassing to report them to the supervisory authority yourself. But you know what’s even more embarrassing (and costly)? When people affected by the data breach report the incident. So in the case of a data breach or unauthorized disclosure of personal information, be sure to:<\/p>\n

    \n
  1. \n

    Contact the affected individuals to mitigate the damage, and<\/p>\n<\/li>\n

  2. \n

    Report the data breach to the authority as soon as possible.<\/p>\n<\/li>\n<\/ol>\n

    [\/vc_column_text][vc_column_text el_class=”info-box-general”]Solution: <\/strong>Act quickly. The GDPR defines a deadline of 72 hours. Learn more in our text about how to deal with data leaks and breaches in a GDPR-compliant way.<\/a>[\/vc_column_text][vc_column_text]<\/p>\n

    Data protection evidence trap<\/h2>\n

    According to Article 5, paragraph 2 of the GDPR,<\/a> you are under accountability. So if you are accused of a data breach, they don’t have to prove that you committed a breach \u2013 you have to prove that you are acting in a data protection compliant manner! Another reason to have a transparent data protection program.<\/p>\n

    [\/vc_column_text][vc_column_text el_class=”info-box-general-twolines”]Solution: <\/strong>An application that lets<\/span> you quickly get real-time data on your data protection strategy on demand.[\/vc_column_text][vc_column_text]<\/p>\n

    One solution for all data security pitfalls<\/h2>\n

    To fully ensure data security in Jira and Confluence, there are several manual solutions and workarounds. Or you can get one app for everything, namely \u00a0Data Protection and Security Toolkit for Jira\/Confluence.<\/a><\/strong><\/p>\n

    Integrate the app into your software, and you have all the tools you need to overcome any hurdles. So, you get full data protection compliance with the GDPR with the least effort.<\/p>\n

    Other data protection regulations such as CCPA, CPRA or HIPAA<\/strong> can also be easily dealt with our data protection app.[\/vc_column_text][vc_single_image image=”7410″ img_size=”full” alignment=”center” onclick=”link_image”][vc_column_text]<\/p>\n

    Advantages of\u00a0Data Protection and Security Toolkit<\/h2>\n