Update Details: A new Business Health and Compliance update has been issued on Protecting Personal Data. The full article has been emailed to subscribers with the Business Health and Compliance preference and is available as a PDF in the Update Service folder.
Why Protecting Personal Data Matters
Most data protection problems don't come from hackers. They come from an email sent to the wrong person, a spreadsheet of customer details nobody has looked at in years, or a marketing list nobody can remember getting consent for. Data protection covers any information about a living person that a business holds, from the moment it is collected to the moment it is deleted, wherever it happens to sit in between.
What the Protecting Personal Data Update Covers
The update starts with a risk assessment: what personal data you hold, why you hold it, where it sits, who you share it with, how long you keep it, and what would happen to the people concerned if it went astray. Most businesses find they hold more than they thought and can explain less of it than they would like.
It then sets out the two forms the risk usually takes: falling short of the legal minimum, which needs no breach to cause a problem, and a data breach itself, which is where the legal minimum earns its keep. A proportionate set of controls follows, running from keeping a record of your processing through to retention, marketing consent, subject access requests and breach response. A closing section covers where ISO 27001 fits, and why significant risks belong on a risks register alongside everything else.
Getting the Full Protecting Personal Data Update
The full update, along with the supporting documents and example risk assessment for managing personal data, is provided to subscribers as part of the update service.
Business Health and Compliance updates are issued as part of the ISO and legal update service and the content is also saved to the Update Service folder (this is in the alphaZ subscribers section) where they can be downloaded in pdf format and used for providing topic-specific training or for sending out as an update to workers.
