General Data Protection Regulation: Data Subject Rights Breach Notification

General Data Protection Regulation
After four years of preparation and debate the GDPR was finally approved by the EU
Parliament on 14 April 2016. It was enforced on 25 May 2018 – and organizations that are
not compliant could now face heavy fines.
Data Subject Rights
Breach Notification Under the GDPR, breach notifications are now mandatory in all
member states where a data breach is likely to “result in a risk for the rights and freedoms
of individuals”. This must be done within 72 hours of first having become aware of the
breach. Data processors are also required to notify their customers, the controllers,
“without undue delay” after first becoming aware of a data breach.
Right to Access
Part of the expanded rights of data subjects outlined by the GDPR is the right for data
subjects to obtain confirmation from the data controller as to whether or not personal data
concerning them is being processed, where and for what purpose. Further, the controller
shall provide a copy of the personal data, free of charge, in an electronic format. This
change is a dramatic shift to data transparency and empowerment of data subjects.
Right to be Forgotten
Also known as Data Erasure, the right to be forgotten entitles the data subject to have the data
controller erase his/her personal data, cease further dissemination of the data, and potentially have
third parties halt processing of the data. The conditions for erasure, as outlined in article 17,
include the data no longer being relevant to original purposes for processing, or a data subject
withdrawing consent. It should also be noted that this right requires controllers to compare the
subjects’ rights to “the public interest in the availability of the data” when considering such
requests.
Data Portability
GDPR introduces data portability – the right for a data subject to receive the personal data
concerning them – which they have previously provided in a ‘commonly use and machine-readable
format’ and have the right to transmit that data to another controller.
Privacy by Design
Privacy by design as a concept has existed for years, but it is only just becoming part of a legal
requirement with the GDPR. At its core, privacy by design calls for the inclusion of data protection
from the onset of the designing of systems, rather than an addition.
Data Protection Officers
Importantly, the Data Protection Officer:
 Must be appointed on the basis of professional qualities and, in particular, expert

knowledge on data protection law and practices
 May be a staff member or an external service provider
 Contact details must be provided to the relevant DPA
 Must be provided with appropriate resources to carry out their tasks and maintain their
expert knowledge
 Must report directly to the highest level of management
 Must not carry out any other tasks that could results in a conflict of interest.
The Indian industry landscape and impact of the GDPR

 Europe is a substantial marketplace for the ITeS, BPO and pharmaceutical
industry in India.
 The size of the IT industry in the top two EU member states (i.e. Germany and
France) is estimated to be around 155–220 billion USD.1 Thus, for the Indian IT
industry to keep continuing to do business in Europe, it needs to comply with the
GDPR.
 The GDPR imposes a penalty structure of 20 million EUR or 4% of global
turnover (on the higher side) in cases of non-compliances.
Areas which need focus under the GDPR are:

 Data processing
 Notice and consent
 Data subject rights
 Accountability
 Cross-border data transfer
 Third-party and vendor management
 Transparency of information and communication
 Data security, storage, breach, breach notification
Indian service providing companies need to:

 Review policies, procedures and existing privacy programmes;
 Conduct data discovery exercises and maintain documentation in order to demonstrate
visibility of the personal data processed;
 Impart data privacy training to employees or subcontractors;
 Implement processes to perform data protection impact assessments (DPIAs), manage
data subject requests, privacy by Design, etc.;
 Review/update contracts signed with third-party vendors.
Recent CyberAttacks in India
1. SIM Swap attack – Bangalore – august 2018 – bank accounts were
hacked and money was transferred.
2. Cosmos Bank, Pune – around Rs 95 crores were siphoned off and
transferred to a Hong Kong bank. The attackers had created a proxy
switch which interacted with the Visa and Rupay payment gateway.
They used this switch to approve fraud payment transactions.
3. Phishing attack on Wipro: Gift card fraud
4. Personal data exposed from JustDial Database: An unprotected API
let the personal information of customers leaked.
How to make your API secure?
 Validate all the incoming data

 Use the essential method for authentication verification
 Monitor and manage using automated scripts
 Encrypt data
How to Prevent Database Hacking?
 Make sure that proper web application firewall is installed

 Strengthen network security by login expiration, changing password,
 Make sure that the admin level of your website is not exposed with a simple
password
 Change the database prefix from wp6 to something random which can’t be
guessed
 Stay updated regarding the latest hacking threats

General Data Protection Regulation: Data Subject Rights Breach Notification

Uploaded by

Copyright:

Available Formats

General Data Protection Regulation: Data Subject Rights Breach Notification

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

General Data Protection Regulation: Data Subject Rights Breach Notification

Uploaded by

Copyright:

Available Formats

General Data Protection Regulation

Data Subject Rights

 Must be appointed on the basis of professional qualities and, in particular, expert

The Indian industry landscape and impact of the GDPR

Areas which need focus under the GDPR are:

Indian service providing companies need to:

How to make your API secure?

 Validate all the incoming data

How to Prevent Database Hacking?

 Make sure that proper web application firewall is installed

You might also like