WIREDGOV

The General Data Protection Regulation (GDPR) will take effect on the 25th May and in support of that the National Cyber Security Centre (NCSC) has worked with...

What does the GDPR mean for cyber security?

The GDPR requires that personal data must be processed securely using appropriate technical and organisational measures. The Regulation does not mandate a specific set of cyber security measures but rather expects you to take ‘appropriate’ action. In other words you need to manage risk. What is appropriate for you will depend upon your circumstances as well as the data you are processing and therefore the risks posed, however there is an expectation you have minimal, established security measures in place. The security measures must be designed into your systems at the outset (referred to as Privacy by Design) and maintained effective throughout the life of your system.

The NCSC have worked with the ICO to develop a set of GDPR Security Outcomes. This guidance provides an overview of what the GDPR says about security and describes a set of security related outcomes that all organisations processing personal data should seek to achieve. The approach is based on four top level aims:

• manage security risk
• protect personal data against cyber attack
• detect security events, and
• minimise the impact

A good starting point for advice on implementing security measures for the GDPR is existing good cyber security guidance. Some good sources of information include our 10 Steps to Cyber Security, Small Business Guide or the Cyber Essentials scheme. You can also share information, advice and intelligence about cyber risks online by joining our CISP community.

Reporting Incidents Involving Personal Data

If you are affected by an incident which involves (or is likely to involve) a breach of personal data, then you are likely to have an obligation under the GDPR to notify the ICO. The ICO provide more detailed guidance on their website about what constitutes a notifiable breach, preparing and responding to breaches.

You may also wish to report significant cyber incidents to the NCSC. If the incident is likely to have a national impact then we will seek to provide support, subject to resource constraints. National impact includes harm to national security, the economy, public confidence, or public health and safety. We would also welcome notification of incidents ‘for information’ which you feel may be of interest, for example incidents which may contribute to our understanding of adversary activity, inform the guidance we provide, or help other organisations.

Incidents below national threshold should be reported to Action Fraud – the UK’s national fraud and cyber crime reporting centre or, if you're in Scotland, then reports should be made to Police Scotland. 

The Information Commissioner’s Office (ICO) is the UK's supervisory authority for the GDPR and is responsible for promoting and enforcing the legislation, as well as providing advice and guidance to organisations and individuals. The ICO has published a lot of helpful guidance on its website. This should be your first port of call for any overarching GDPR queries you might have.

The GDPR Security Outcomes can be read here in full