How Can an Organisation Protect Personal Information? Complete Security

-

 

How Can an Organisation Protect Personal Information? Complete Security

  • What is "personal data"?
  • How does the legislation regulate the storage and processing of personal data?
  • How to protect personal data from intruders?
Personal data (PD) - any information relating directly or indirectly to a specific or identifiable individual (the subject of personal data).

It follows from the definition that the list of personal data includes not only basic information about a person (passport data, phone number, etc.) but also links to one's own website, a profile on social networks and other elements of personalization.

The key official document on PD is Federal Law No. 152-FZ "On Personal Data" dated July 27, 2006, from which, in particular, it follows that the operator of personal data de jure becomes any organization that receives and processes information about citizens (employees, customers, visitors). By law, she is obliged:

  • report this to Roskomnadzor ;
  • have the consent of the subject to the processing of personal data;
  • notify him of the termination of the processing and the destruction of personal data.

Since July 1, 2017, the grounds for bringing to administrative responsibility have been expanded and fines have been increased.

A fine for legal entities for non-compliance with the safety of personal data is up to 50,000 rubles. (Part 6 of Art.13.11 of the Administrative Code of the Russian Federation).

Failure by the operator, when processing personal data without using automation tools, to comply with conditions that ensure their safety and exclude unauthorized access to them, if this entailed illegal or accidental access to data, their destruction, modification, blocking, copying, provision, distribution or other illegal actions against them.

In addition, an organization can be fined if:

  • processes PD illegally;
  • collects PD for purposes not declared to Roskomnadzor;
  • does not publish its policy on the processing and protection of personal data;
  • does not fulfil the requirements for anonymization, clarification, blocking, destruction of PD;
  • does not ensure the safety of personal data and measures for their non-disclosure.

To comply with Federal Law No. 152, the operator is obliged to notify Roskomnadzor of his intention to process personal data before processing personal data (cases excluding this requirement are specified in Part 2 of Article 22 of Federal Law No. 152-FZ). Among other things, the operator of personal data must inform Roskomnadzor of the purpose of collecting and storing personal data, issue documentation (order, regulation, rules, methods and procedure for processing personal data), and ensure the consent of the subject to the processing of PD. And the main thing that is necessary is to take measures to protect personal data. Hardware and software solutions used in government agencies must be certified by the FSTEC (Decree of the Government of the Russian Federation of 01.11.2012 No. 1119).

Personal data protection means in the organization and at the enterprise

More than half of the attacks carried out by cybercriminals on state-owned companies are aimed at obtaining personal data, including personal data of an employee.

Ensuring the complete security of personal data is a task that can be solved by using the Traffic Inspector Next Generation FSTEC certified universal security gateway (UTM).

Firewalls corresponding to the fourth protection class can be used:

  • in state information systems of the first class of security;
  • in automated control systems for production and technological processes of the first class of security;
  • in personal data information systems, if necessary to ensure the first level of personal data protection;
  • in public information systems of the second class.

Comments

Post a Comment

Popular posts from this blog

Why Not to Restart Your Computer if It Is Infected With the Ransomware | Total Security

-
Image
The Internet has made our lives easy, especially in the field of online buying and selling, but with simplicity come greater challenges. One of the main issues that come with shopping online is its security concerns. So far this year, more than a thousand shoppers in Australia alone have reported cases of online shopping fraud, and 56.6 percent of those cases come with massive financial losses. As the Internet has become our daily tool for trading, investing, and consuming content, we cannot stop buying and selling online, although we are at risk of phishing from scammers who get richer by defrauding users, so we can do a lot to prevent our money from being stolen and defrauded. Buying from various online stores. This article provides practical advice for smart shopping online. These tips are classified into two parts: 1- Prevention Tips - How to protect yourself from fraud and deception while shopping on the Internet? 2- Tips - What do you do after being deceived? 1- How to protect yo...
Read more

What Is a Ransomware Virus and How Do You Protect Your Computer From It | Total Security

-
Image
The attacker then demands a ransom from the victim to regain access to the data upon payment in a virtual currency such as Bitcoin. You are presented with instructions on how to pay a fee to obtain the decryption key. Costs can range from a few hundred dollars to thousands, and you pay cybercriminals in Bitcoin. What are the types of ransomware? Depending on the result of the attack, ransomware can be classified into the following categories: Locker Ransomware: ransomware that shuts down your system and demands a ransom is classified to give you access to locker ransomware. Crypto-Ransomware: This type of ransomware encrypts your files and forces you to pay a specified amount of money to decrypt your files. The victim is required to pay for the anti-virus program that removes this virus. Ransomware Android Mobile Device: This type of ransomware either permanently close your mobile phone or steals its sensitive data, and requires a ransom to unlock it or to return the data. IoT Ransomwa...
Read more

What is a zero-day threat? Free Antivirus Software

-
Image
Day zero refers to the time since the vulnerability was discovered by software developers. There are two types of zero-day threats. A zero-day vulnerability is a software security flaw that can be reproduced in a browser or application. A zero-day attack is an attempt to install malware on a victim's computer by exploiting a zero-day vulnerability in the program. How Do Zero-Day Threats Arise? As the name suggests, a zero-day vulnerability is not yet known to the developer, antivirus companies, or the general public - zero-day attacks are carried out by cybercriminals who were among other things, vulnerabilities in browsers and e-mail clients are especially often exploited in zero-day attacks due to their widespread distribution among users. How to Recognize a Zero-day Attack? Once discovered by users and developers, these are no longer zero-day threats! This is why zero-day attacks are one of the most difficult types of threats with the most devastating consequences today, but the...
Read more