This article contains information on GDPR compliance, including its seven principles, best practices for protecting personal data, and how organizations can balance employee privacy with data protection using Incydr's tools and strategies.
Overview
Personal data. It's everywhere. And it seems everyone is claiming that it is their right to collect, store, and process it. But privacy regulations, such as the EU's General Data Protection Regulation (GDPR), have defined specific requirements around the proper collection, use, storage, and destruction of personal data. This course will outline some of the specific requirements put forth by GDPR and suggest best practices for how organizations can strike the balance between protection and privacy.
Prerequisites
- You are an Incydr Administrator or Security Practitioner, with beginner to intermediate experience level.
- You are familiar with Incydr.
An Overview of GDPR
Consult with Legal Counsel
Incydr is not providing legal advice. The information contained herein is provided for general informational purposes only. Consult your own legal counsel for data protection requirements.
The General Data Protection Regulation
In 2016, the European Union (EU) adopted the General Data Protection Regulation (GDPR), which addresses data privacy rights of those in the EU and the European Economic Area (EEA). Not only does it affect those companies within the EU and EEA, but also companies that handle personal data of those in the EU and/or EEA, regardless of where the company is based, which has, essentially, made it the worldwide standard for privacy protections of personal data.
When it comes to protecting personal data, how does that apply to companies and their employees? Are the protections still the same? Can organizations protect their data from insider risk and protect their employees' privacy at the same time?
Yes, they can!
This course is going to outline best practices for organizations to protect the privacy rights of their employees without sacrificing the protection of their assets.
Key Terminology
Personal Data
GDPR's definition:
'personal data' means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
In other words, Personal Data is any data that could be used to identify someone.
That's a lot of potential data! And many of those are routine pieces of data for employers to have pertaining to their prospective, existing, and departed employees: name, address, taxpayer identification numbers, gender, health information, and economic status.
While GDPR doesn't outright prohibit companies from collecting and using personal data, it does say companies must only do so in alignment with its data protection principles.
The Seven Principles of GDPR
The seven principles of GDPR are outlined in Chapter II Article 5. The first six define how companies can interact with personal data, and the seventh principle requires the ability to audit compliance with the first six.
"(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);"
What does that mean?
- For companies processing employee data, the lawful basis typically comes from "performance of a contract," "legal obligation," or the catchall, "legitimate interests."
- The company needs to be transparent about the who, what, where, when, why, and how of its collection.
"(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);"
What does that mean?
- Companies need to fully understand the reason they are collecting data and then only use the data they collect for that purpose.
"(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);"
What does that mean?
- Don't collect more data than is needed for the purpose(s) outlined in the Purpose Limitation principle above.
"(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);"
What does that mean?
- Personal data needs to be kept up to date or destroyed.
"(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);"
What does that mean?
- Personal data should not be kept longer than necessary for the specific purpose it was collected.
"(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)."
What does that mean?
- Personal data needs to be protected from internal and external risks.
"2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’)."
What does that mean?
- Companies need a way to prove they have been adhering to the first six principles.
How Are Companies Supposed to do All That?
By taking a holistic approach across people, process, and technology, companies can be prepared to adhere to the seven principles of GDPR. This course will explore examples of how companies can do just that.
But first, let's see some examples of companies who failed to meet GDPR requirements and what happened to them.
Real World Examples
What Happens When Someone is Non-compliant?
Article 83 of GDPR outlines the potential fines for companies who fall out of compliance. The most severe carries a maximum of €20 million or 4% of the company's worldwide annual turnover, whichever is higher.
Amazon Fined $887 Million
"La Quadrature du Net’s original May 2018 complaint, which was filed on behalf of 10,000 people, claimed that Amazon’s advertising system isn’t based on 'free consent.'"
Consent is covered in Article 7.
As of Q1 2023, this is the largest fine in GDPR history.
Meta Fined $275 Million
"Facebook was fined for 'failing to apply Data Protection by Design and Default' as stipulated by the EU update to General Data Protection Regulation (GDPR)."
And this wasn't Facebook/Meta's first time. Across 2021 and 2022, it was fined over €912 million.
Data protection by design and by default is covered in Article 25.
Want More Examples?
Check out the links below for more information on GDPR fines and real-world examples:
People
It All Starts with People
All risks and any associated risk mitigations start with the people involved in deciding what constitutes a risk to the business, what risk(s) should be prioritized, and how to prevent, detect, respond to, and recover from those risks.
When it comes to GDPR, defining what employee personal data is collected, how it's collected, how it's used once collected, how it's maintained after collection, and how and when it's destroyed requires a company-wide effort.
Who's involved, and What Responsibilities Does Each Team Have?
Every organization is different, but typically, at least the following departments/roles are involved during the process:
HR is tasked with reinforcing the culture of the organization, and a company compliant with GDPR needs to have data protection engrained in its culture.
HR will also work closely with Legal to create an Employee Privacy Policy. These policies outline the company's approach to protection of its resources, including its most-important resource: employees.
HR should also receive regular training on appropriate access and use of employee data.
IT is typically involved with configuring and maintaining the business systems that collect employee data, including managing controls and access. IT should be aware of compliance requirements, and receive training on appropriate access and use.
Security will be in charge of inquiring and investigating events of insider risk that may be in violation of the Acceptable Use Policy, which they will lead creating. Playbooks should be created to adhere to privacy requirements (set forth by HR and Legal) from initial inquiry through response and take into account checks and balances to maintain integrity and confidentiality. Security should receive training on appropriate access and use.
Depending on the company, Legal, GRC, and Privacy might all be the same department or they could be separate. Regardless, these teams are all in charge of understanding the requirements of and risks to personal data compliance, as it affects the company.
Looking for more in-depth information on a specific team or topic mentioned in this course? Check the Additional Resources section at the end of this course for more-advanced content.
Process
Compliance is a continually moving target. Fortunately, companies can create policies that can act as guardrails for maintaining compliance across the principles of GDPR. Every privacy principle of GDPR has a process element to it, so this section is broken down by each principle.
Want to see an Employee Privacy Policy template that helps address many of the GDPR requirements? Check the Additional Resources at the end of this course.
The company should define why and what data needs to be collected from employees and what gives them the lawful right to collect/use it. For employee data, the lawful basis is usually "performance of a contract" or "legal obligation."
When it comes to insider risk protection, the following purpose is a good place to start.
Visibility into all of an organization's data events to/from company resources to protect against loss, leak, and theft.
Incorporating diverse stakeholders across the organization in these conversations will help the company make sure they are minimizing any blind spots when it comes to assets and requirements.
Collecting data events as part of an Insider Risk Management (IRM) program can help organizations do so in a documented, consistent, and fair manner.
For transparency, companies need to be transparent about the entire lifecycle of the data collected from their employees including:
- What data the company is collecting
- What the company is doing with the data
By having appropriate policies and communications in place that are readily available, employees can get the transparency they need, which helps to build trust within the organization and ensures they (the data subjects) are aware of their privacy rights.
After defining the business purpose to collect employee data, the company must:
- Only use the collected data for the intended purpose.
- Implement policies that document what and why data will be collected and how it will be used.
- Communicate the purpose to the employee base and how the data will be used.
A best practice is for companies to create a "hub" of these policies and communications in their internal documentation so it is readily accessible for employees.
Ultimately, it goes back to the first principle: transparency is key.
For example, if file event data is collected from all endpoints for the legitimate interest of watching for file exfiltration, the organization can't decide later on to use that data for productivity monitoring of employees. If productivity monitoring is a requirement, the business has to go through the process again to define the legitimate interest.
WARNING
Many EU/EEA countries and/or their respective Works Councils (WCs) have additional regulations regarding what can or cannot be done with employee data, such as restrictions on productivity monitoring. Legal/GRC/Privacy should determine any requirements.
Data minimization follows the intended purpose of the collection and use. If the purpose of an IRM Program is to protect the company from data loss, leak, and theft, any technology or collection methods must collect only the data needed for that purpose.
For example, monitoring exfiltration events from a company asset may be in scope, but collection should be limited to company assets–tracking someone's personal device that is only being used for personal use would be out of scope.
In conjunction with storage limitation, data minimization also includes limiting processing of data only to that which is relevant for the specified purpose and removing the ability to process data that is no longer relevant. In other words, event data retention limits will also minimize data.
When it comes to insider risk, it is important for organizations to have up-to-date information on all of their employees, contractors, and vendors. Any time this is out of date, the data subject should be able to update this information. Policies should be put in place for how to make the change or put in a request for a change.
Personal data should be deleted or anonymized once it no longer serves the purpose (unless there is a legal basis for retaining it). Policies and procedures should be implemented that define the length of time data can be kept to satisfy its purpose. IT, Security, and Legal should work together to determine the appropriate storage limitation for each purpose.
Companies need to create policies and procedures to protect and maintain the protection on any collected data. These will include policies on encryption, multi-factor authentication (MFA), and software updates.
To keep personal data the company is holding secure, the company should ensure it has measures in place to protect against both external and internal risks.
When it comes to mitigating insider risk, administrative controls, such as training on appropriate data use, and physical controls, such as secure access, may also need to be implemented to remain compliant with this principle.
A "supervisory authority" is responsible for monitoring compliance with GDPR in each member state. Companies should maintain detailed documentation of how the company is adhering to the first six principles and be prepared to show this documentation if/when they are audited.
Technology
The Incydr IRM solution is designed to help detect risk events: suspicious file movement, unapproved sharing, and exfiltration activities.
Organizations can use Incydr in an environment regulated by GDPR by following the seven principles throughout its use.
For a detailed breakdown of how Incydr can help companies comply with GDPR, view our white paper.
For Incydr's compliance with standards and regulations, check out our Privacy and Compliance page.
How to Use Incydr with the Principles?
Login banners, posters, emails, chat messages (e.g. via Slack or Teams), and verbal communications are all great ways to be transparent and keep security top of mind.
In order to ensure all of an organization's data is protected, Incydr monitors endpoint/cloud data for all employees. For Incydr Professional, Enterprise, and Horizon product plans, Incydr only collects endpoint files that have been exfiltrated. If any collected data is not part of a security event/case, it will automatically delete after the product plan's retention period. File events and contents are only retained if there is a security reason to keep them.
Incydr uses inferred trust to track data going from a corporate source to an unmonitored device, which minimizes the need to collect data from a personal device while still protecting corporate data.
If enabled, Incydr can sync employee information from a configured SCIM tool to provision users within an Incydr environment and maintain information (such as first name, last name, and department) via identity management. Using an identity provider as the "source of truth" makes it easier to maintain accuracy across tools including Incydr and Instructor.
For general file event and content collection, Incydr has a secure-by-design storage limitation that varies depending on the particular product plan, which deletes collected events and files after the period expires. If file events/contents are needed for an investigation, Incydr includes tools for case management, which allows for retainment of events attached to a case for longer than the default retention period.
For file events/contents in a case, Incydr has automatic case archival, which also has a variable timeframe depending on product plan. Once a case is archived, the attached file events and contents are permanently deleted, but the case notes and information are available for auditing.
Incydr's role-based access controls (RBAC) help companies ensure the integrity and confidentiality of data and investigations to help prevent and protect against unauthorized access or unapproved use.
If using automation or interacting from the command line, Incydr's API Clients allow granular permissions for any specific task.
See our other articles, for a more-detailed breakdown of Incydr's architecture and our Security, Privacy, and Compliance for even more information.
Part of maintaining the appropriate confidentiality of files collected by Incydr is to have a standard operating procedure (template available in Additional Resources) outlining under what circumstances the investigation team can request access to those files, the approvals required, and the erasure of the content at the conclusion of any retention period.
Incydr includes an Audit Log, that tracks events and changes throughout the Incydr environment and can be used to "watch the watchers."
The Incydr Instructor micro-learning solution specifically designed for adult learning to guide employees and help companies prevent and respond to risk events. Instructor's proactive and situational videos are designed to be given before an event occurs (such as annual training or when a role change occurs), while responsive videos can be triggered to send after certain risk criteria have been met.
By using Instructor's built-in functionality for video tracking or incorporating Instructor content into your Learning Management System (LMS), organization's can also demonstrate accountability for satisfying some principles of compliance.
(To view any videos mentioned below, navigate to the Instructor tab in your console, or reach out to your CSM for more information).
Proactive
Proactive lessons promote safe security and data handling. These lessons presume positive intent and teach employees security best practices.
Insider Risk & You
- Reminder for all users about the risks they pose to data in their day-to-day work and how to avoid them.
- Sent annually.
New IRM Program
- Introduce your employees to the IRM program and provides some best practices in protecting the company from risk.
- Sent out at program rollout and for new hires to be alerted to its existence.
Risks of Not Separating Personal/Business
- What are the dangers of using a company-owned device for personal use?
- Sent annually.
Templates (requires login) to communicate security program objectives and continue transparency:
- Poster templates, communication templates, and response templates are available for Instructor customers for a variety of instances, such as chat applications, iCloud, email, USB, etc.
Responsive
Responsive lessons provide just-in-time training as soon as a user makes a mistake. These lessons are non-accusatory and personable, which lets users learn from their mistakes and build a positive relationship with the security team.
When it comes to GDPR, these videos are indispensable tools to help alert users to their prohibited actions and grants them a chance to correct their behavior or seek guidance.
Videos should be sent that match the appropriate triggering action. Instructor has a library of videos that correlate with the risk setting detection capabilities of Incydr.
Ecosystem Integrations
Incydr and Instructor were both designed to fit within an organization's larger ecosystem. In addition to Incydr's built-in detection and response capabilities, integrating with an HRIS, SIEM, and/or SOAR can speed up workflows, collect information in a central location, and perform additional response tasks.
There are many ways to integrate Incydr.
Reach out to your CSM or our sales team for more information.
Summary
Yes, Companies Can Have Both
Going back to our original question: "Can organizations both protect their data and their employee's privacy at the same time?" Yes, they can! But it requires a holistic approach to insider risk management across people, process, and technology. Stakeholders in the organization should work together to coordinate the approach to GDPR's seven principles and confirm it aligns with their company culture and values. This approach should include:
- Communication and transparency about the lawfulness and purpose of the protection strategy.
- Policies and procedures to maintain the integrity and confidentiality of collected data, minimize the required data collected, and storage limitation by design.
- Procedures to maintain the accuracy of any collected data and allow for correcting as needed.
- A way to prove the company has been adhering to the first six principles and keep itself accountable for the requirements.
GDPR compliance isn't easy but it's important. For companies that align their people, process, and technology, it's possible to have both privacy and protection.
Knowledge Check
Question One: Incydr and Instructor can be used in an environment subject to GDPR requirements.
- False
- True
The answer is True.
Question Two: How many processing principles does GDPR have?
- 3
- 5
- 7
- 11
The answer is 7.
Question Three: What must a company align to create a holistic IRM Program that can both protect company data and employee privacy? (pick 3)
- Consent
- People
- Process
- Accountability
- Technology
The answer is 2, 3 & 5.
Additional Resources
Templates
Incydr Security, Privacy, and Compliance
- Incydr Security, Privacy, and Compliance
- Incydr & GDPR
- Incydr & GDPR White Paper
- Incydr's Data Processing Addendum (DPA)
Getting Started with Incydr
General Resources
Questions or Comments?
Reach out to your Customer Success Manager (CSM).
Comments
Please sign in to leave a comment.