Cybersecurity and GDPR: 15 lessons from regulatory practice

Here are 15 lessons based on an analysis of various data protection authority decisions across Europe, from a GDPR and cybersecurity article I just submitted after a reputed information security journal reached out.

Cybersecurity compliance beyond best practices: key lessons:

1) Document your risk assessments and decisions.
=> If you deviate from common best practices, explain and document why.

2) Ensure the proper implementation of any risk assessment.
=> Identifying a risk isn’t enough – follow through with action.

3) Use the latest software versions and heed vendor upgrade notices (notably: update your antivirus and endpoint protection tools).

4) Perform regular penetration testing and vulnerability scanning.

5) Carry out a root cause analysis for each security incident and follow up properly.

6) Train personnel to mitigate human vulnerabilities, like phishing.

7) Have a documented and tested Disaster Recovery Plan (DRP).
=> If you believe a DRP isn’t necessary, document why and what alternatives you’re using.

8) Document all security measures, and be ready and willing to defend yourself.
=> Regulators regularly rely on allegations of infringements and assumptions, and they are worth challenging.

9) Ensure adequate user identification and logging practices, taking into account the sensitivity and criticality of data.
=> Especially avoid shared credentials and lack of traceability, even for senior staff.

10) Consider all implications before discarding logs or choosing not to generate them.
=> Consider how logs support data subject rights, like the right of access.

11) Set, communicate about and enforce clear internal policies on what users are permitted and prohibited from doing.

12) Do not focus only on external threat actors in risk assessments – also anticipate possible misuse of systems.

13) Prioritise identified risks based on their likelihood and severity.

14) Ensure actual implementation and evidence of security policies and technical controls.
=> Policies alone are insufficient – they must be operationalised.

15) Always ask yourself: what is best practice, and what is proportionate?
=> The law supports well-reasoned, well-documented approaches.

Want to know more, where the lessons come from and what they mean for your business? Reach out!