## 5 Governance and Policy on Data Protection  
General Data Protection Regulation (GDPR) as it applies in the UK and EU nations, was facilitated in the UK by the Data Protection Act 2018. The General Data Protection Regulation is a Europe-wide law that replaced the Data Protection Act 1998 in the UK. It places a greater obligation on how organisations handle personal data. It came into effect on 25 May 2018 [19]. The GDPR applies to \"personal data\" and since its introduction, businesses and organisations have had to follow a new way of working in order to make sure data are safe and protected. With the introduction of GDPR, the UK government through its surveys has recognised a drop in personal information being misused. Global threat has taken a public profile and concerns people in all aspects of life and businesses and has become of relevance in policies. In order to take this forward, the section will discuss the wider definition of the theories of data protection and their approach towards rules and safeguards that have emerged through surveys and facts that have been collected in the past few years. As is known to the public, there has been a rise in cyber-attacks with public bodies such as the National Health Service (NHS), BUPA, EasyJet, and British Airways to name a few, that have seen their data being breached, stolen, ransomed, and other varieties of attacks displayed on them. The Information Commissioner's Office (ICO) governing body has been able to act and penalise these organisations based on the GDPR policies and has made these organisations tighten their own internal policies and procedures and take the importance of IT to the front burner of their organisation [19]. In a recent news coverage by the BBC on EasyJet, May 2020 [20], it was reported that a \"highly sophisticated cyber-attack\" had affected approximately nine million customers' data. It was understood that the hackers stole credit card data including the three-digit security code, known as the Card Verification Value (CVV) number, on the back of the card itself. Following from a case like this, the ICO plays an important role in making sure the policies of GDPR were followed and people's right to know that an organisation as big as EasyJet handled their data appropriately, securely, and responsibly. In another report by the BBC, ransomware was the method used in an attack on the NHS back in 2017 [21]. NHS Digital said the attack was believed to have been carried out by the malware variant Wanna Decryptor. The NHS is a huge organisation thus having many providers supporting their IT infrastructure and core network. The BBC reported that \"Complexity is the enemy of security\" and went on to emphasise that some networks could have benefitted from updated security patches and computers upgraded to stop the cyber threat from occurring. This led to hackers being able to easily penetrate the network of the NHS and cause disruption and financial loss. According to CSO Online [22] Cyber Attack Statistical Report March 2020; showed eight key cybersecurity statistics at-a-glance:  
1. 94% of malware is delivered via email. 2. Phishing attacks account for more than 80% of reported security incidents. 3. 60% of breaches involved vulnerabilities for which a patch was available but not applied. 4. 63% of companies said their data were potentially compromised within the last twelve months due to a hardware- or silicon-level security breach. 5. Attacks on IoT devices tripled in the first half of 2019. 6. File-less attacks grew by 256% over the first half of 2019. 7. Businesses will fall victim to a ransomware attack every 11 s by 2021. 8. 83% of respondents experienced a phishing attack in 2018. The statistics above clearly show that businesses need to follow guidelines of GDPR, ICO and Cybersecurity.