GDPR is the General Data Protection Regulation, Regulation (EU) 2016/679. It governs how personal data of people in the EU is collected, used, stored and protected. It has applied since 25 May 2018.

Who does GDPR apply to?

Any organisation that processes personal data of people in the EU, wherever the organisation is based. It covers customers, employees and any other individual whose data is handled.

What are the main principles of GDPR?

• Lawfulness, fairness and transparency: a legal basis and clear information.
• Purpose limitation: data is used only for stated purposes.
• Data minimisation: only the data that is needed.
• Accuracy: data is kept correct.
• Storage limitation: data is not kept longer than necessary.
• Integrity and confidentiality: data is protected against unauthorised access.
• Accountability: the organisation can show how it complies.

What rights do individuals have?

People can ask to access their data, correct it, have it erased, restrict or object to its use and receive it in a portable format. Organisations need to know where personal data is held, and who can reach it, to answer these requests.

What is the difference between a controller and a processor?

The controller decides why and how personal data is processed. The processor handles it on the controller’s behalf. Both have duties, and a security provider that handles personal data in the course of its service is usually a processor.

What does GDPR require on security?

Organisations must apply appropriate technical and organisational measures to protect personal data, in proportion to the risk. Controlling who can access personal data, and being able to detect misuse, are central to confidentiality and integrity.

What is data protection by design and by default?

It means building data protection into systems from the start, and making sure that by default only the data needed for each purpose is processed. For monitoring, that points to collecting the minimum, restricting who sees it and keeping it only as long as needed.

What is the GDPR breach notification rule?

When a personal data breach is likely to put people at risk, the organisation must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. If the risk is high, the affected people must also be informed. Quickly working out which accounts and data were involved makes that deadline much easier to meet.

How does GDPR affect identity monitoring?

Monitoring what employees and accounts do involves personal data. It needs a legal basis, a clear purpose, transparency and proportionality. Collect what is needed to detect misuse and no more, limit who can see it, and consider a data protection impact assessment where monitoring is systematic. Involve legal, privacy and, where applicable, employee representatives early.

How do identity security and GDPR support each other?

Least privilege reduces who can reach personal data. Monitoring helps detect misuse and shortens the time to understand a breach. Records of who accessed what support accountability. Done well, security and privacy reinforce each other.

How does GDPR relate to NIS2 and DORA?

GDPR protects personal data. NIS2 and DORA aim at the security and resilience of systems and services. They overlap on security measures and incident reporting, with different scope and deadlines, and organisations often need to meet all those that apply.

What are the penalties?

For the most serious infringements, fines can reach 20 million euros or 4% of worldwide annual turnover, whichever is higher.

Sharelock is a European, GDPR-native platform, designed so that identity monitoring can be proportionate and reviewable.

‍