Month: March 2019

GDPR Compliances for an Indian Companies

Posted on by admin

The European Union (EU) is known for its strict regulations when it comes to data privacy and information security. The systems need to comply with their guidelines in order to function in the EU. Recently, the EU has introduced a set of regulations for the protection of data processing and free movement of data pertinent to natural persons residing in the EU. These regulations are known as the GDPR and are it has extraterrestrial applications. Which means that any entities processing or moving the data of the EU residents need to comply with the GDPR. This has far-reaching implications for foreign entities such as Indian companies in the data processing space.

The impact of GDPR on Indian companies is profound. The Information Technology industry in India is widespread and a large number of companies find themselves in a place where they need to comply with the GDPR to conduct transactions with the EU. So let us take a look at what Indian companies need to achieve in order to work with EU residents in the data sector.

The EU explains GDPR as, “The General Data Protection Regulation 2016/679 is a regulation within the European Union and the European Economic Area that pertains to data protection and privacy for all individuals. It also identifies and addresses the export of personal data outside the EU and EEA areas.”

Here, ‘personal data’ refers to the information related to an identified or identifiable natural persons. Which means any entity with an identification, security numbers, genetic identification, or any specific form of identification is considered a natural person. So any information pertaining to a natural person who is a resident of the EU is considered personal data under the GDPR.

For any foreign entity, such as Indian companies, dealing with the personal data of the EU residents, it is imperative to ensure that their systems are compliant with the GDPR norms and the data protection requirements are in place. This means that most Indian companies need to redefine their privacy policies and bring about certain pertinent changes in their system.

Also Read –  5 ways to remain GDPR compliant in 2019

It is not only important but lawfully stipulated that companies comply with the GDPR stipulation as the penalties for non-compliance are severe in the EU law. It can prove to be an invitation to penalties up to 10,00,000 to 20,00,000 euros or 2-4% of the global turnover of the previous financial year, whichever is higher. Most EU companies insist on  GDPR compliance  as a standard contractual clause so as to ensure complete security of their data. Indian Government is also looking at updating and introducing laws to ensure stronger data protection compliances and guidelines for Indian Companies. Meanwhile, it goes without saying that any company in India which is looking at working with the EU needs to update its data protection policies in order to continue its business transactions. Currently, the trends in the GDPR compliances beg the question of how Indian companies are preparing for this switch. For this, the following questions need to be pondered upon-

  • What is the data footprint of Indian companies in EU?
  • Are Indian companies equipped and prepared to provide evidence of GDPR compliances to the stakeholders who may request them ?
  • Do Indian companies have a holistic understanding of what data is collected and how it is used and processed?
  • Is there a defined roadmap for GDPR compliances?
  • What cross border data transfer strategies are we adopting as Indian organizations?

In a recent seminar titled, GDPR: Post Implementation Review, the following points were discussed to make the compliances more relevant-

  • Global Privacy Challenges: The seminar addressed global security challenges beyond GDPR and addressed the fact that while GDPR is important, it not an answer to all problems. Given the recent developments in countries like Brazil and India, the companies recognized privacy as the new normal, and decided to work to build efficient programs to address privacy challenges.
  • Maintaining a Culture of Privacy Awareness: A key concern for most business is to maintain a culture of privacy in their organizations. Because of how some people view GDPR as a checklist to be completed rather than an ongoing responsibility, this concern was discussed at length.
  • Territorial Scope: Various companies struggle to identify the territorial scope of GDPR given that it only applies to EU residents. However, a lot of North American businesses now abide by GDPR as a company policy rather than a mandate for EU.
  • GDPR and Future Privacy Challenges: With the advent of Ai, Machine Learning and Big Data, companies have struggled to interpret the application of GDPR in the global scenario.   This discussion lead to the future challenges of GDPR that will require innovative solutions.

While this may seem like a lot of information, the right guidance can help you with these compliances. QRC solutions has a team of experts who guide and help you acquire the  GDPR certification  without much hassle.

PCI DSS Guidelines To Combat Against Card Skimming

Posted on by admin

According to The Payment Card Industry Data Security Standard (PCI DSS), businesses carrying out their transactions online are mandated to maintain certain guidelines in order to safeguard the interests and data of their users. These guidelines combat various issues such as data theft, hacking, fishing, and even card skimming.

Card skimming is the theft of credit card data by attaching external devices to card reading devices in the public and covertly stealing the card data and passwords for later use. This is a form of credit card fraud as these people monitor legitimate credit card transactions and steal the credit card information by the use of small external devices such as cameras or scanners. Usually, all of this data is stored in a plastic card’s magnetic stripe. The devices used for skimming or theft of the credit card data are known as card skimmers. These skimmers are a form of cameras or scanners which are placed over the card readers of public card machines or ATMs, and when any transaction is carried out, they record the card details and passwords in another plastic card via the magnetic stripe and clone the credit card. This way, they can use a credit card without the consent of the owner.

In order to avoid incidences of card skimming, the PCI DSS has requirements in place which give instructions on how to avoid incidences of credit card fraud.

The  Requirement 9.9  in PCI DSS standards for security against physical access, that explicitly states, “Protect devices that capture payment card data via direct physical interaction with the card from tampering and substitution.” Which implies that businesses require to ensure that their card reading devices need to be protected and monitored from tampering of any kind and special attention needs to be paid to ensure that there is no substitution of devices of any sorts.

In detail, the Section 9.9  asks businesses to make a list of all the devices they own, inspect the devices frequently, and train the security personnel to detect and be aware of suspicious behaviour. These guidelines are recommended but not mandatory. However, given the recently increased instances of criminals using skimmers to steal credit card information, it is strongly advised that businesses take PCI DSS recommendations very seriously.

Recently, there have been various instances of card skimming where criminals have been caught with hundreds of cloned credit cards and skimming devices to further their crimes. A couple of Romanian criminals was recently caught by the police with an external skimming device attached to a public ATM in New Delhi, along with a small camera and various plastic cards. They intended on recording the passwords of the credit cards as they were entered and then entering all of this information on the plastic cards that they owned. Thankfully, these criminals were arrested before they could cause any problems. PCI DSS allows a framework to businesses to ensure that they are protected from such theft and criminals who skim credit card data. These guidelines are key to secure and safe transactions without having to worry about any kind of theft or fraud.

QRC Solutions allows you to ensure the  PCI DSS compliances  in order to ensure that your business is safe against card skimmers. With the guidance of the experts, it is imperative that your business will be secured from any credit card frauds that may occur.

PCI SSC’s First Ever Security Forum In India

Posted on by admin

13th March’19, mark the date on your calendar because it’s going to be a day of networking and educational sessions at the 2019 India Forum in Delhi. The PCI Security Standards Council is going to hold its first ever India Forum in Delhi providing you access to tools and information to secure payment data. The forum and the sessions will provide deep insight into the world of payment security, thus helping you to understand the latest trends and techniques in the industry. Leaders from PCI Security Standards Council would also give their insight on the future of the industry.

QRC Solutionz is one of the leading partners to the event and would be present to understand your challenges and discuss hot topics in the industry. Our leaders would be happy to brainstorm with you on your industry concerns and understand how steps toward a safer payment space can be attained.

PCI compliance is undoubtedly, the need of the hour for every payment related company in the country today. Credit card data is such a valuable target and data being compromised can lead to huge losses.

At QRC Solutionz, we always advise our clients that achieving  PCI compliance  with an initial audit is not the roadblock – but maintaining the compliance is. More so since the changes in the ecosystem are continuous – what you may have perceived as a complaint-safe system may well differ in the next few days. This is specifically why it is of utmost importance to be updated constantly on the industry happenings.

We constantly push our goals higher so that we, along with our partners, are not just checking boxes to be compliant, but to implement and maintain effective network security – ensuring that you are always compliant.

QRC Solutionz’s diverse clientele ranges from fortune 500 companies to startups in India and the silicon valley. Our detailed approach helps our clients understand the benefit of being constantly compliant and reaching out to the next level of security understanding. There’s a big gap that is present today between the requirement and the genuine need of the industry and that is exactly what we aim to close.

So, let’s chat up and delve into the finer details of payment security and it’s processes at the 2019 India Forum. Looking forward to an interesting conversation.