Cyber security and the UK GDPR: where they meet

Many small businesses treat data protection compliance as a paperwork exercise: a privacy notice, a consent form, a few contract clauses. All of that has its place, but the UK GDPR also asks for something more concrete: personal data must be kept secure against unauthorised access, loss and damage. This is where data protection and cyber security stop being separate subjects and start depending on each other.

What the UK GDPR says about security

The UK GDPR, which applies alongside the Data Protection Act 2018, addresses security at several points. One of its core principles, in Article 5(1)(f), is integrity and confidentiality: personal data must be processed in a way that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. Article 5(2) adds the accountability principle: the controller is responsible for compliance and must be able to demonstrate it.

Article 32 turns the principle into an obligation. Controllers and processors must put in place technical and organisational measures that ensure a level of security appropriate to the risk, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the risks to individuals. The article lists, as appropriate:

• pseudonymisation and encryption of personal data;
• the ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services;
• the ability to restore availability of and access to personal data in a timely manner after a physical or technical incident;
• a process for regularly testing, assessing and evaluating the effectiveness of the measures.

The law does not require specific products or technologies. That gives flexibility, but it also leaves managers with the task of deciding what is appropriate for the size of the business and the type of data it handles.

Where the two subjects meet in practice

Almost every basic cyber security control has a direct bearing on the protection of personal data:

• User access control: limiting who can see the customer database or the payroll reduces the chance of a breach, whether deliberate or accidental.
• Security updates: known flaws in out-of-date systems are among the most common ways in for intrusions that end up exposing data.
• Malware protection: ransomware and spyware can copy or encrypt entire databases before anyone notices.
• Firewalls and secure configuration: these reduce the services exposed to the internet and the default settings that make attacks easier.
• Backups: restoring data quickly after an incident is precisely one of the abilities Article 32 mentions.

These points largely match the controls of Cyber Essentials, presented in the article on the five basic cyber security controls. Cyber Essentials is not a certification mechanism under the UK GDPR, and holding the certificate does not by itself prove compliance. Even so, adopting a recognised baseline helps to organise the technical measures and to show that the business made considered choices rather than improvised ones.

Personal data breaches

The UK GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The definition is wider than a cyber attack: an email sent to the wrong recipient or a lost laptop can also qualify, and so can personal data made unavailable by ransomware.

Under Article 33, the controller must report a breach to the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. A report made later must explain the reasons for the delay, and information may be provided in phases if it is not all available at once. Under Article 34, when a breach is likely to result in a high risk to individuals, the business must also tell the people affected without undue delay.

Two further rules are easy to overlook. Every breach must be documented, including those that are not reported to the ICO, with the facts, the effects and the remedial action taken. And when a supplier processes personal data on the business's behalf, as an outsourced IT provider often does, that supplier must notify the business without undue delay after becoming aware of a breach.

Seventy-two hours is not long for a business that has never thought about the subject. During an incident, it needs to find out which systems were affected, what types of data they held, how many people may be affected and what risk this represents. Without a data inventory, access logs and a designated person in charge, those answers take time. Some preparatory measures help:

1. keep a map of what personal data the business holds and which systems store it;
2. enable and retain access logs on the main systems;
3. decide who assesses whether an incident involves personal data and who decides on reporting it;
4. keep to hand the contact details of the person responsible for data protection (a formal data protection officer is mandatory only in certain cases), your legal advisers and your IT supplier.

The guide to the first 30 minutes of an incident includes checking whether personal data is involved among the first actions for this reason.

Accountability and suppliers

Article 24 requires the controller to implement appropriate measures to ensure, and to be able to demonstrate, that processing complies with the law, including data protection policies where proportionate. Article 28 deals with suppliers: a business may only use processors that provide sufficient guarantees, and the written contract with them must include, among other things, the obligation to take the security measures required by Article 32.

For an SME, this does not have to mean a complex structure. It means, for example:

• having short, workable policies on passwords, device use and access to systems;
• training staff periodically, using everyday examples;
• reviewing contracts with suppliers that process personal data on the business's behalf;
• recording the measures adopted and the reviews carried out over time.

That record has value in its own right. When an incident occurs, being able to show what was done, when and why is very different from having nothing to present.

A realistic starting point

No set of measures eliminates the risk of incidents, and the law does not require that. What it asks is that security be appropriate to the risk and that the business be able to respond when something happens. For most SMEs, starting with the basic technical controls, mapping the most sensitive personal data and preparing an incident response already puts the business in a much better position.

This article is for general information and is not legal advice. Each business should assess its obligations with the support of qualified professionals.

Checklist of common ground

• The personal data held by the business has been mapped.
• Access to that data is restricted to those who need it.
• Systems that store personal data receive security updates.
• Databases containing personal data have tested backups.
• Access logs are enabled on the main systems.
• It has been decided who assesses breaches and who reports them to the ICO.
• All personal data breaches are recorded, including those not reported.
• Contracts with suppliers that process personal data include security obligations.
• The measures adopted are documented.