WHITE PAPER (TRIPWIRE)

Getting up to Speed on GDPR

Preparing for the General Data Protection Regulation

Fortra.com

Fortra White Paper

Search online for the phrase “data is the new oil” and you’ll
see it’s used by (and attributed to) many people. Data is

Getting up to Speed on GDPRONE REGULATOR TO RULE THEM ALL

a precious and highly valuable commodity. Data is thefuel pumping through today’s digital business, poweringcommunications and commerce. Organizations the world
over are mining data to turn raw information into real
insight—to drive sales and grow their business.
The trade-off for this great power is, as the saying goes,
great responsibility. That’s another reason why data is likeoil—because it’s a nightmare to clean up when it leaks.
Therefore, organizations must ensure they’re protecting
their data with appropriate systems and policies. As such,information security will figure prominently in developing acomprehensive approach to EU GDPR.
The upcoming EU General Data Protection Regulation, togive its full title, comes with stringent provisions aroundprotecting any data that could identify a living person.
Although the law is EU-based law, GDPR applies to allorganizations globally that wishes to do business with,or monitor the behavior of, EU citizens, no matter if theU n d e r G D P R , o r g a n iz a t io n s n o w o n ly needt o p ic k o n e s u p e r v is o r y a u t h o r it y t h ey
w a n t t o w o r k w it h , s u c h a s t h e In f o r mati on
C o m m is s io n e r ’ s O f f ic e in t h e U K o r t he D ata
P r o t e c t io n C o m m is s io n e r in Ir e la n d . T hat’ s
a s o lid im p r o v e m e n t f r o m t h e o ld e r datap r o t e c t io n r e g im e t h a t r e q u ir e d w o rki ng
w it h r e g u la t o r s in e v e r y E U M e m b e r State i n
w h ic h t h e y w a n t t o d o b u s in e s s . T h is ended
u p b e in g a b u r e a u c r a t ic n ig h t m a r e , i n the
E U ’ s o w n w o r d s , f o r m u lt in a t io n a ls . GD P R
s im p lif ie s m a t t e r s f o r a n y o r g a n iz a t i on thatd e a ls w it h m u lt ip le E U M e m b e r St a t es. I t
s c r a p s t h e n e e d t o n o t if y o r r e g is t e r f or datap r o c e s s in g w it h e a c h lo c a l d a t a p r o tecti on
a u t h o r it y, w h ic h w a s c o s t in g b u s in e ss €1 30
m illio n p e r ye a r . G D P R m e a n s j u s t a si ngl es e t o f d a t a p r o t e c t io n r u le s t o c o m pl y w i th,a n d o n e a u t h o r it y f o r r e p o r t in g a c r o ss thee n t ir e E U .

company is domiciled within or outside the European
Union. Organizations covered by the regulation needto demonstrate they are protecting that information inaccordance with the rules; failure to do so carries serious
financial consequences.
While some people will inevitably roll their eyes at the thoughtof having to meet new regulatory requirements, it’s worthThis white paper outlines the key points you need to know
about EU GDPR, and the implications the new rules have forbusinesses that handle personally identifiable data. From
there, it outlines some of the steps your business should
consider taking to prepare for the rules. Special attention is
given to “appropriate security to the personal data” and the

keeping in mind that the reform process stemmed from afoundational controls required for “security processing.”

desire to increase the trust of EU residents that their personal

Tell Me More About GDPR

data is secure. The EU’s larger agenda is to create greater
confidence in digital services, e-commerce and the cloud.
As the European Union is the second largest economy,
as a bloc, in the world with a GDP of €16.5 trillion (US$ 17.7
trillion), this is a significant move in protecting the rights of
its citizens. Further, it enables those citizens to engage with
online providers and other vendors with the confidence thatcertain protections their personal information are in place.
So, that implies that organizations following the rules in asecure, transparent way will earn this trust from consumers,
and as a result can potentially grow their business. Toooften, we see regulatory compliance as a cost, but inthis light GDPR should be seen as a business opportunity
enabling businesses to access that market.

Fortra.com

GDPR has been described as the biggest development
in information law in two decades. Not only is it intended
to increase privacy for individuals, it hands dataprotection regulators much tougher powers to act againstorganizations that breach the new rules—but more aboutthat later.
GDPR is a new European Union law that harmonizes theprevious European data protection regime across 28 EU
member states. After a four-year reform and consultation
period, GDPR came into force on May 24, 2016 and it applies
from May 25, 2018.
It was drawn up partly in response to demand from
European citizens for the same data protection rights acrossthe EU, and it enshrines that protection as a fundamental

Page 2Fortra White Paper

Getting up to Speed on GDPR

right. It also gives us a much broader definition of what

Just as importantly, the rules apply to all companies that

constitutes personal data that could identify a living

process data relating to EU citizens, regardless of whereindividual:

that data is ultimately stored or processed. The rules are“‘personal data’ means any information relating toan identified or identifiable natural person (‘data
subject’); an identifiable natural person is one who
can be identified, directly or indirectly, in particular
by reference to an identifier such as a name, an
identification number, location data, an online
identifier or to one or more factors specific to thephysical, physiological, genetic, mental, economic,
cultural or social identity of that natural person;”Organizations that process personal data must:•

Obtain clear consent from the subject of that data•

Obtain parental consent if the subject is a child under
the age of 16•

Provide a copy of an individual’s personal data in a
portable format if requested to do so•Erase all personally identifiable records of anindividual if asked to do so•

Provide adequate security to protect that data•

Notify their regulator in the event of any security
breach that impacts on the personal data entrusted
to them

Uniform Approach

Under the Data Protection directive 95/46/EC (which
preceded GDPR), there were 28 different versions of European
Data Protection rules as each member state within the
EU implemented the directive into their own statue books
according to each country’s requirements. The core principlesof the Data Protection Directive were enacted into eachcountry’s legal system, but because the directive wasenacted under each EU member state’s own legal system,
each one was slightly different. This resulted in a confusing
tapestry of data protection laws throughout the EU which
companies operating in each of those countries had tonavigate very carefully. This often resulted in increased
compliance costs and efforts, and in some cases companies
complying with the data protection rules in one EU member
state while inadvertently breaching those in another.
The EU GDPR will apply one harmonized set of rules nomatter where in the EU the data subject happens to be.
What’s more, as a regulation it will come into force without
any country needing to implement national legislation.

Fortra.com

partly a reaction to technology developments like the cloud,which lets companies transfer large quantities of datafrom one jurisdiction to another—even outside the EU—
instantaneously. To put it another way, don’t let the namefool you—in effect, the EU GDPR is a global law.

We’ve Got You Covered

From May 25, 2018, EU GDPR applies to all companies—nomatter where their headquarters are—that control andprocess personally identifiable information about EU citizens.

Fine, Let’s Get This Over With

First the unpleasant part. The fines for failing to comply
with GDPR are more severe than under the current dataprotection regime, and the compliance obligations are more
onerous because the regulation affects all organizations
that do business, provide services, or carry out activities onbehalf of individuals in the EU.
Under the EU GDPR, data protection authorities in all EU
member states have more wide-ranging powers to impose
potentially significant fines for any business that fails to comply
with the regulations. This is a significant change in the dataprotection regulatory regime as previously the data protection
authorities would have to bring a case to court and it would
be up to the court to determine if the accused party was guilty
and what fine to impose. The new regime gives more power
to the data protection regulator and will no doubt result in
more organizations who breach data protection regulations
facing penalties. In addition to these new powers for the dataprotection regulators the penalties are much larger than under
the current data protection regime.
The most serious instances of non-compliance carry fines
up to a maximum 4% of the guilty company’s worldwide
revenues or €20 million, whichever is higher. That figurealone has earned GDPR a lot of headlines since the law was
published, but it relates to specific offences involving dataprocessing, consent, data subject rights, non-compliancewith the order of a data protection authority, or transfer ofdata to a third party.
There’s a second band of fines of up to €10 million or 2% of
global turnover for a range of other offences relating to childconsent, transparency of information and communication,

Page 3Fortra White Paper

Getting up to Speed on GDPR

data processing, security, storage, breach and breach

Unless regularly processing personally identifiable data is a

notification, and transfers related to appropriate safeguards

core business activity, Small & Medium Enterprises (SMEs)

and binding corporate rules.

employing fewer than 250 people are exempt from theAs can be seen, failure to comply with the EU GDPR can havesignificant financial implications for organizations who run
afoul of their Data Protection regulator.

Time is Ticking

Another key element of the EU GDPR is the introduction of
mandatory notification requirement for companies that
suffer a security breach resulting in the exposure of personal
data belonging to customers. The EU GDPR forces allorganizations to report breaches involving personal data totheir local data protection authority—where feasible within
72 hours of the breach being identified. If there’s any delay,
the controller must provide a “reasoned justification” for this.
That structure alone puts pressure on organizations tobe very proactive in watching for possible breaches, andis just one example of where GDPR has a direct effecton an organization’s information security posture. Manyorganizations struggle with timely breach discovery:
Verizon’s Data Breach Investigations Report found that
attackers can compromise systems in days or less (often
minutes) but victims often don’t find out until much later.
GDPR is also intended to give EU residents easy access topersonal information that almost any organization holds
about them. If requested, that organization must provide
detailed information not just about the type of data it holds,
but also the reason why it’s doing so, and the methods forwhich that data is being processed.

Go DPO

Until now, it hasn’t been mandatory for organizations toappoint a designated individual with responsibility fordata protection, commonly known as a Data Protection
Officer (DPO). This too is another big change under GDPR.
Organizations whose core activity involves processing
personal data on a large scale—involving more than
5,000 data subjects in a 12-month period—must appointa designated Data Protection Officer (DPO). This can be astaff member or a service provider under contract, but theappointment should be based on their professional qualities
and specifically having expert knowledge of data protection
laws. The role must be independent and autonomous andmust have a direct line of reporting to senior management.

Fortra.com

obligation to employ a DPO, although appointing a DPO isnevertheless seen as good practice.
The International Association of Privacy Professionals has
produced a study which estimates that up to 75,000 new DPO
positions will be created as a result of companies needing
to meet their GDPR requirements. Early industry commentarysuggests that number is a conservative estimate.
The DPO post has a wide-ranging remit that covers:•

Developing and implementing a data protection
policy for the business•

Providing guidance on best practice for processing
personal data•

Organizing employee training•

Coordinating any requests for information under theterms of the regulation

The EU’s Article 29 Working Party has provided guidance on
the DPO role, which should help businesses map out suitablejob descriptions and identify whether they already havequalified people who could fulfill the role, or whether they’ll
need to recruit externally.

Cut to the Chase

So, let’s get to the most relevant parts of the legislation froman information security standpoint: GDPR requires data
controllers to implement “adequate measures” to ensure theconfidentiality and integrity of its processing systems andthe information they hold. As the regulation states:“Personal data shall be… processed in a mannerthat ensures appropriate security of the personaldata, including protection against unauthorisedor unlawful processing and against accidental
loss, destruction or damage, using appropriatetechnical or organisational measures (‘integrity andconfidentiality’).”This wording is intended to be both technologicallyneutral and future-proofed, but a useful working initialinterpretation is:•

You should have critical security controls that can
detect, manage and mitigate appropriately any
vulnerabilities to your data processing environment•

Your systems should be configured in accordancewith the enterprise policy, and maintain that
configuration

Page 4

Fortra White Paper•Your security systems should be capable ofidentifying any deviations from the policy•

You should continuously monitor your log files to alert
to any potential breaches or vulnerabilities•

You should detect, respond to, and remediate any
detected incidents effectively•

You should engage securely with the cloud•Sensitive personal data should be encrypted at
rest and in transit. In particular, sensitive personal
data stored on portable devices such as laptops or
smartphones should be encrypted•

Access control to where sensitive data is stored
should be implemented on a need to know basis andreviewed regularly

While the regulations don’t say it explicitly, GDPR effectively
requires organizations to have a defined security strategy
that conforms to accepted industry standards.

Getting up to Speed on GDPRT

THE PEOPLE’S RIGHTS

A n i n d i v i d u a l i n t h e E U , o r “ d a t a s u b j ect” in
G D PR - s p e a k, c a n :• A s k t h e d a t a c o n t r o lle r t o e r a s e h er/hi s
p e r s o n a l d a t a , c e a s e f u r t h e r d is s emi nati ono f t h e d a t a , a n d p o t e n t ia lly h a v e t hi rd
p a r t ie s c e a s e p r o c e s s in g o f t h a t d ata. T hi s
is a ls o k n o w n a s ‘ t h e r ig h t t o b e f o rgotten’• H a v e a c c e s s t o , a n d in f o r m a t io n a bout,t h e p e r s o n a l d a t a t h a t a c o n t r o lle r has
c o n c e r n in g t h e m ( a ls o k n o w n a s ‘ t he ri ght
t o a c c e s s ’ o r ‘ s u b j e c t a c c e s s r ig h t ’ ) .
T h e s e r ig h t s a r e im p o r t a n t t o k n o w becauset h e y d ir e c t ly a f f e c t h o w yo u r o r g a n i z ati on
h a n d le s d a t a , a n d h o w yo u r s t a f f a r e trai ned
to respond to any such requests.

Some useful frameworks to benchmark yourself against
include:•

ISO/IEC 27001/27002•

NIST Cybersecurity Framework•

CIS Critical Security Controls

The systems, controls and processes that you use to monitor
data assets should align with these standards. Interestingly,
one of the general conditions for imposing administrativefines under GDPR involves:‘the degree of responsibility of the controller or processor
taking into account technical and organisational measures
implemented by them pursuant to Articles 25 and 32’.

that just 46% of organizations are confident they will beready in time for GDPR’s implementation date.
It’s important to remember that GDPR is in force across all
EU member states from May 25, 2018. Once that date wasreached there is no further grace period or time to ramp up
your compliance.

How is GDPR Enforced?

As mentioned earlier, each Data Protection regulator has
new powers to ensure compliance with the EU GDPR and toprosecute breaches of the same. In the main, there are three
key actions that the Data Protection regulators can take to

In other words, being able to show you had appropriate

ensure organizations are complying with the requirements

security measures in place prior to an incident may reduceof the EU GDPR. These are:the financial impact of that event. That’s a business case forincreasing security investments that you can take straight tothe board.

Remind Me When I Needed to Be Ready
for GDPR?

May 25 2018 is the date by which EU GDPR became law within
all member states, so from that date onward organizations
need to be compliant. Some organizations may have someof the requirements for compliance already in place due toProactive Audit—The data protection authority’s officehas the ability to conduct audits against organizations toensure they comply with the EU GDPR. These audits caneither be announced audits, which are arranged andagreed in advance with the organization to be audited, or
unannounced audits whereby the regulator can conduct
an audit against an organization without any prearrangements or warning. They can audit and apply fines
directly.

their efforts to be compliant with the existing Data Protection

In response to a complaint—The regulator can investigate

laws in the EU member states. However, many morean organization in response to a complaint made againstorganizations are not, especially those organizations thatan organization to the regulator’s office. The regulator can

are located outside the European Union but who provide

investigate the organization to determine if the individual’sservices to EU citizens. A survey from CA Technologies foundcomplaint is valid.

Fortra.com

Page 5Fortra White Paper

If there is a data security breach—In the event of asecurity breach impacting the personal information

Getting up to Speed on GDPR

GDPR GOOD PRACTICE: A SECURITY CHECKLISTof individuals, the Data Protection regulator will get
involved to determine if the organization that suffered
the breach had taken “adequate measures” to protect
the data entrusted to it.
The Data Protection regulator has the power topunish organizations it determines not to meet therequirements of the EU GDPR by placing fines against
the organization, requiring the offending organizations
take the necessary steps to ensure compliance, and/or the deletion of any data that has been gathered orprocessed unfairly.

What Steps Do I Need to Take to Be
Compliant?
The first key step for organizations to ensurecompliance with the EU GDPR is to realize and accept
that compliance is a critical business issue, and not
an IT one. Getting buy-in from senior management
or board is an essential first step in ensuring
your compliance efforts will be successful, andorganization-wide.
Some key questions to ask are:A r t ic le 3 2 o f G D P R is e n t it le d “s e c u r it y o f p r ocessi ng, ”
a n d it c a lls f o r t h e d a t a p r o c e s s o r t o im p le ment“a p p r o p r ia t e t e c h n ic a l a n d o r g a n iz a t io n a l measurest o e n s u r e a le v e l o f s e c u r it y a p p r o p r ia t e t o the ri sk. ”
The examples it provides includes:• P s e u d o n ym iz a t io n , m in im iz a t io n a n d e n c rypti on of
personal data
• T h e a b ilit y t o e n s u r e t h e o n g o in g c o n f id e n ti al i ty,
in t e g r it y, a v a ila b ilit y a n d r e s ilie n c e o f p r ocessi ng
s ys t e m s a n d s e r v ic e s• T h e a b ilit y t o r e s t o r e t h e a v a ila b ilit y a n d access top e r s o n a l d a t a in a t im e ly m a n n e r in t h e e vent of ap h ys ic a l o r t e c h n ic a l in c id e n t• A p r o c e s s f o r r e g u la r ly t e s t in g , a s s e s s in g ande v a lu a t in g t h e e f f e c t iv e n e s s o f t e c h n ic a l ando r g a n iz a t io n a l m e a s u r e s f o r e n s u r in g t h e securi ty
o f t h e p r o c e s s in g .
Yo u s h o u ld b e a b le t o m o n it o r yo u r s e c u r it y control sc o n s t a n t ly a n d r e v ie w t h e m t o e n s u r e t h e y arec o n t in u in g t o p r o t e c t t h e p e r s o n a l d a t a yo u hol d.
T h is le v e l o f m o n it o r in g is f o u n d a t io n a l t o y ours e c u r it y p r o c e s s in g e f f o r t s .
CHANGE CONTROL

on? Is this application authorized?

Can you identify when unplanned

You will also be able to spot changes

changes introduce security weaknesses?

to those systems quickly, and apply

Do you have the ability to perform

appropriate security in a timely fashion.

regular scans to look for potential new

If any of those systems don’t meet yourvulnerabilities, prioritize them and get

requirements or if configurations are•

Can you identify every piece of customer data
across all of your systems and applications?

•

Can you prove that you have the necessaryconsents to hold the customer data you have inyour systems?

them remedied as quickly as possible?

not to the appropriate security level

Active monitoring for unauthorized

you’ve determined, your layered security

changes on important systems canapproach should alert you to those

Could you erase every instance of a customer’s
data if requested to do so?

identify weaknesses or possible points

potential risk exposures.

of attack.

••Could you provide a customer with their data ina portable format?

•

Are you confident that the customer data
entrusted to you is secured using all adequate
measures?

FILE INTEGRITY MONITORING

VULNERABILITY MANAGEMENT

Regular testing of security controls for

The ability to see when changes arevulnerabilities, and where they occur,

made to critical files or systems is thegives you the information you need to

first step to understanding whether

address those weaknesses proactively.

those changes have been made for

These vulnerabilities may be in themalicious reasons. This can provide thesoftware, system configuration, process,crucial early warning capability when aor human layers, so it’s important to haveThis means that you need to understand what personal

system has been breached.

a tool that allows you to correctly identify

information you store and process, who it refers to, andCONFIGURATION MANAGEMENT

how it is managed and how well it’s secured. If Data
Protection regulations and laws are not a core strength
within your organization, you should consider engaging
with an external consultancy or audit team that canevaluate your security measures and your controls

When critical systems have been
designed and implemented in a secure

the nature of any potential changes.
LOG MANAGEMENT

Regularly review the logs to identify

way – whether that’s email servers,

suspicious behavior or be available if afile servers or database servers – itbreach occurs to investigate and contain.

becomes easier to add new systems or

Do you have real time intelligence

applications in a similarly secure way,

and automation for fast and accurate

as appropriate. Is encryption turned

reporting for incident response?

around critical information.
You also need to determine if all or any of your dataprocessing takes place in-house or whether it’s

Fortra.com

Page 6

Fortra White Paper

Getting up to Speed on GDPR

outsourced to an external provider that processes the data

The DPO post is likely to be a wide-ranging remit that covers

on your behalf. EU GDPR states that data controllers:developing and implementing a data protection policy‘should use only processors providing sufficientguarantees, in particular in terms of expert
knowledge, reliability and resources, to implement
technical and organisational measures which willmeet the requirements of this Regulation, including
for the security of processing’.
The above statement is a key one to take into account as
it not only refers to traditional data processing outsourcing

for the business, providing guidance on best practice forprocessing personal data, organizing employee training,and coordinating any requests for information under theterms of the regulation.

Review Your Policies and Processes—Then
Make Sure You Can Enforce Them

Now is the time to review how your organization works withdata and what happens to it through its lifecycle. Pay close

but also how you engage with cloud service providers.

attention to the security of controls, and identify where any

Fine Amounts

position of strength; research from Netskope found that as

Up to €20 million, or 4% of global turnover.

vulnerabilities could be. You might not be starting from amany as three quarters of apps would fall foul of GDPR, andWhat Can I Ignore?

a survey from Ipswitch suggests that many organizations

you’re not affected by EU GDPR. But given the expanded

order to meet the compliance requirements laid out in theIf you don’t process personally identifiable information, thenwould need further investment in their security systems inscope of the regulations, that puts you in the minority of

new rules.

organizations.

Training

Next Steps•

Talk to your auditor•

Assess what data you have and where and how it’s
stored. Determine whether or not that data should beprotected using encryption and/or pseudonymization.

•

If your organization adheres to a security framework,
review and document the alignment and map it to
the data flow

As with most elements of good security, the human element
plays a critical if often overlooked role. Security awarenesstraining can ensure your organization is on the right footwhen handling personal data and handling access requests
from data subjects in a timely way.
When it comes to security, training and awareness offerssome of the best returns on investment you could hope to•

Design a step-by-step process to becoming andstaying compliant

get. Ensure your staff knows what constitutes personally•

Set-up a cross-departmental task force withexecutive sponsorship

technical and intellectual, to ensure they safeguard it

With such wide-ranging impact from GDPR, the sooner you

identifiable data, and that you give them the tools, both
appropriately at all times.

start compliance efforts, the better.

Summary

Appoint a Data Protection Officer

organization already complies with current data protection

Your organization will need to formally appoint someone
to the role of Data Protection Officer, or DPO, as part of
GDPR compliance. The International Association of Privacy
Professionals produced a study which estimated that up
to 75,000 new DPO positions will be created as a resultof companies needing to meet their GDPR requirements.
Early industry commentary suggests that number is aconservative estimate.

Fortra.com

GDPR may seem onerous at first glance, but if yourregulations, it should be a relatively small step to take inorder to align with the updated controls and requirements
because many of the fundamentals remain the same. The
key consideration is that the new changes, around financial
penalties and mandatory breach disclosure terms, will makedata protection more a business issue than an IT issue. With
the implementation deadline of May 2018 in the rear-view
mirror, now is the time to comply with GDPR.

Page 7

Fortra White Paper

Getting up to Speed on GDPR

About the Author

Brian Honan is recognized internationally as an expert in thefield of information security. He has worked with numerous
companies in the private sector and with government
departments in Ireland, Europe and throughout the United
Kingdom. Brian has provided advice to the European
Commission on matters relating to information security,and is on the advisory board for a number of innovative
information security companies.
Brian is the author of ISO 27001 in a Windows Environmentand co-author of The Cloud Security Rules. He has been
regularly published in many trade publications, is a prolificinformation security blogger, and blogs for Information
Security magazine. He is also European Editor of SANSNewsBites newsletter, which is published twice a week toover 500,000 information security professionals worldwide.
Brian’s speaks regularly at various industry conferencessuch as RSA Conference Europe, BruCON, SOURCE Barcelona,
BSides London, IDC Security, and the ICS Data Protection
Conference, among others.
www.bhconsulting.ie
www.bhconsulting.ie/securitywatch

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

© Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.

(tw-gd-1023-r1-hm)