Update Details: A new Business Health and Compliance update has been issued on Protecting Personal Data. The full article has been emailed to subscribers with the Business Health and Compliance preference and is available as a PDF on the Business Health and Compliance Updates page.
Why Protecting Personal Data Matters
Most data protection problems don't come from hackers. They come from an email sent to the wrong person, a spreadsheet of customer details nobody has looked at in years, or a marketing list nobody can remember getting consent for. Data protection covers any information about a living person that a business holds, from the moment it is collected to the moment it is deleted, wherever it happens to sit in between.
What the Protecting Personal Data Update Covers
The update starts with a risk assessment: what personal data you hold, why you hold it, where it sits, who you share it with, how long you keep it, and what would happen to the people concerned if it went astray. Most businesses find they hold more than they thought and can explain less of it than they would like.
It then sets out the two forms the risk usually takes: falling short of the legal minimum, which needs no breach to cause a problem, and a data breach itself, which is where the legal minimum earns its keep. A proportionate set of controls follows, running from keeping a record of your processing through to retention, marketing consent, subject access requests and breach response. A closing section covers where ISO 27001 fits, and why significant risks belong on a risks register alongside everything else.
Getting the Full Protecting Personal Data Update
The full update, along with the supporting documents and example risk assessment for managing personal data, is provided to subscribers as part of the update service.
Business Health and Compliance updates are issued as part of the ISO and legal update service, so each issue is emailed to subscribers as it is published. Every issue is also listed on the Business Health and Compliance Updates page, where anyone can see what has been covered and alphaZ subscribers can download the updates in pdf format, for topic-specific training or for sending out to workers.
