From 25 May 2018, public and private entities will have to ensure compliance with the General Data Protection Regulation (GDPR). With fines that can reach 4% of global annual turnover or 20 million euros, the consequences for organisations that are not prepared could be catastrophic.

The GDPR will have a marked impact on organisations' information systems. Personal data processing activities rely fundamentally on automated means of data processing, so it is essential that these are prepared to ensure compliance with the new privacy and data protection rules.

We share the 5 measures you should apply to your company's information systems, which are also set out in the GDPR guide from the Shared Services of the Ministry of Health.

5 measures for applying the GDPR in ICT

1. Mapping of Systems and Applications in Use

A survey should be carried out of all systems and applications in which personal data is recorded, identifying their features, access levels and the security measures implemented.

2. Verification of Traceability Tools

It should be checked whether there are tools that allow the traceability of data access, entry, modification and deletion (logs) and, if so, whether such a tool is implemented for all systems and/or applications.

3. Risk and Vulnerability Assessments

In order to assess whether systems and/or applications are robust and, consequently, suitable for ensuring compliance with the new obligations arising from the GDPR, risk assessments (PIA), penetration tests and attack simulations should be carried out.

4. Adapting Systems to the GDPR

It should be ensured that systems and applications support, from the outset, the following features:

• Data portability;
• Interoperability;
• Anonymisation, pseudonymisation and encryption;
• Data security;
• Access to, rectification and erasure of data;
• Alert systems in the event of a security incident;
• Records of processing operations;
• Audits;
• Traceability of data disclosed to third parties;
• Access control.

5. Alert Mechanisms

Systems and applications should be implemented so that alerts are generated in the event of vulnerabilities and/or security breaches. These mechanisms will enable those responsible for information systems to identify the incident and put in place the necessary measures to minimise the risks to privacy.

Find out more about the new general data protection regulation with the eBook "GDPR - The Essential Guide".

Written by:
Openlimits

Tell us what you think