The Classification Conundrum #ISO27001

An important step to effectively manage information security risks is identifying how many information Classifications you have. The ISO27001 standard supports through clause 8.2.1 “Information should be classified in terms of legal requirements, value, criticality and sensitivity to unauthorised disclosure or modification”.  There is no standard answer to how many are needed. It is one… Read More

How to track down your personal data (Data Mapping)

One of the early stages to prepare for the General Data Protection Regulation (GDPR) is identifying the Personal Data you process; this blog provides a framework to build a Personal Data Inventory. An inventory is not a requirement of the GDPR, but it is a good way to build up a picture of the personal… Read More

Legitimate Interests – 3 part test

Legitimate interests (LI) is one of the lawful basis for processing personal data. The ICO say it is appropriate “where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing”. The three parts to the test to identify a LI have been… Read More

Perception vs Reality of cyber crime

Would you consider your house as secure if it had been broken into in the past year, and the police had not caught the gang that was breaking into most of the other houses on your street? Probably not. Compare this to businesses and cyber crime. A recent report indicates there is a disconnect between the reality… Read More

Why the silent treatment will not be an option for your business

If your business stores any personal information – and that includes name, email address, and telephone numbers – you need to be aware of the data protection changes that will be enforced from May 2018 when the General Data Protection Regulation (GDPR) replaces the Data Protection Act. A common question is what about the Brexit… Read More