Author: admin

GDPR : Who does it Cover and Requirements ?

Posted on by admin
This article is part of our GDPR compliance consultancy services hub page, designed to help businesses understand GDPR scope, applicability, and compliance requirements. In this blog, we explain who GDPR applies to, which organizations need to comply, and the key requirements for protecting personal data when handling information of individuals covered under the regulation.

On May 25, 2018, the EU’s 1995 Data Protection Directive and all member state laws based on it were replaced by the GDPR (General Data Protection Regulation), a pan-European data protection regulation. The GDPR introduces a 21st-century approach to data protection with its significant and extensive scope. It gives people more control over how their personal data is gathered and processed and gives organisations (both controllers and processors) several additional requirements to be more accountable for data protection. The Data Protection Act of 2018 in Ireland, which took effect on May 25, 2018, complies with the GDPR’s limited chances for member states to create provisions or derogations for how the Regulation applies in their nation.

Who is covered by the GDPR?
  • Even if they are not EU citizens, all EU organisations that gather, store, or otherwise process the personal data of people who reside in the EU.
  • Companies situated outside of the EU that provide goods or services to residents there, observe their behaviour, or handle their personal data.
GDPR requirements are:
1. Accountability and Governance
You must be able to demonstrate compliance with the GDPR. This includes:
  • creating a system for governance with jobs and duties.
  • keeping thorough records of each and every data processing operation.
  • preserving policies and practises for data protection.
  • conducting DPIAs (data protection impact assessments) for processing procedures that pose a high risk.
  • putting in place the necessary safeguards to protect personal data.
  • training for staff members’ awareness.
  • appointing a data protection officer as necessary.
2. The six data processing principles
Six data processing principles are outlined in the GDPR and must be followed by data controllers. Personal information must be:
  • Processed lawfully, fairly and transparently.
  • Collected only for specific legitimate purposes.
  • Adequate, relevant and limited to what is necessary.
  • Accurate and, where necessary, kept up to date.
  • Stored only as long as is necessary.
  • Processed in a manner that ensures appropriate security.
3. Lawful processing
Personal data can only be treated in the following ways, with the exception of particular categories of data, which cannot be processed except in certain circumstances:
  • If the data subject has given their consent
  • To meet contractual obligations
  • To comply with legal obligations
  • To protect the data subject’s vital interests
  • For tasks in the public interest
  • For the legitimate interests of the organisation
4. Data subjects’ rights
Data subjects have:
  • The right to be informed
  • The right of access
  • The right to rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object and
  • Rights concerning automated decision-making and profiling.
5. Valid consent
There are stricter rules regarding consent:
  • Freely granted, specific, informed, and unambiguous consent is required.
  • A request for consent must be understandable and written in unambiguous terms.
  • Consent will no longer be accepted in the form of inaction, pre-ticked boxes, or silence.
  • Anytime can be used to revoke consent.
  • Only with parental approval is a child’s internet service consent legitimate.
  • Organizations are required to provide proof of permission.
6. Data protection by design and by default
Data controllers and processors are required to put in place organisational and technical measures that are intended to effectively apply the data processing principles.
  • The processing should incorporate the necessary safeguards.
  • Any new procedure, system, or technological advancement must take data protection into account during the design phase.
  • An essential component of privacy by design is a DPIA (data protection impact assessment).
7. Transparency and privacy notices
Organizations must be transparent about how, why, and who will process personal data.
  • Data controllers are required to give data subjects a privacy notice when collecting personal information directly from them.
  • Data controllers shall deliver a privacy notice without undue delay and within a month where personal data is not collected directly from data subjects. The first time they speak with the data subject, they must do this.
  • Data controllers must decide how the data subjects will be informed for all processing activities and then write privacy notices accordingly. Notices may be given out gradually.
  • Data subjects must get privacy notices in a clear, visible, and easily available format using plain English.
8. Data transfers outside the EU
After the transition period is through, many non-EU organisations that process the personal data of EU citizens must also appoint an EU representative.
  • When a nation has been recognized by the EU as offering a sufficient level of data protection
  • through standard contractual provisions or legally binding business practices
  • by adhering to an accepted certification procedure.
9. Mandatory data breach notification
A breach of security that results in the unintentional or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data that is transmitted, stored, or otherwise processed is referred to as a personal data breach under the GDPR.
  • All breaches of personal data must be reported to data controllers by data processors.
  • If there is a threat to the rights and freedoms of data subjects, data controllers are obligated to notify breaches to the supervisory authority (the Data Protection Commission (DPC) in Ireland) within 72 hours of becoming aware of them.
  • If there is a significant risk to the rights and freedoms of the data subjects, they must be informed without undue delay.
10. DPOs (data protection officers)
You must be able to show that the GDPR is being followed. This comprises:
  • establishing a system for governance with positions and duties
  • maintaining a thorough log of all data processing activities
  • maintaining policies and practises for data protection
  • performing DPIAs (data protection impact assessments) for processing processes that pose a high risk
  • putting in place the necessary safeguards to protect personal data
  • whenever necessary, conducting staff awareness training and establishing a data protection officer

Understanding Various Levels Of Merchants Service Provider

Posted on by admin

Any Merchant and Service provider Reporting a PCI DSS Compliance by two different validation methods:

  1. Self-Assessment Questionnaire (SAQ)
  1. SAQ is a validation tool for merchants and service providers to report the results of their PCI DSS self-assessment, if they are not required to submit ROC
  2. Includes a series of yes-or-no questions for each applicable PCI DSS requirement
  3. Different SAQs available to meet different merchant environments.

B. Onsite Assessment by Qualified Security Assessor

  1. Onsite assessment is a validation mechanism for merchants and service providers by a Qualified Security Assessor (QSA)
  2. QSA submits the Report on Compliance (ROC) and attestation Of Compliance (AOC)
  3. QSA and authorized  person at merchant/service provider entity require to sign the AOC
  1. How to identify what applies to your organization? SAQ or Onsite Assessment?
  1. If you are a merchant, depends on your annual transactions per year across all channels, payment card brands defined four levels.
  2. If you are a service provider, depends on your annual transactions per year across all channels, payment card brands defined two levels.
  3. All levels, except Level 1, must complete a self-assessment questionnaire as well as have a quarterly external vulnerability scan using an Approved Scanning Vendor (ASV).
  1. Merchants PCI Compliance Levels:

Definition of Merchant: The entity directly provide service and/or Product to the End customer and get the Money through various channels. Examples like Hotels, Restaurants, Airlines, Hospitals, Online Shopping Portals etc.,

Note: Depends on the Type of SAQ Applicable for your organization, there is a need of performing Internal Vulnerability scans and Penetration testing. Read our Blog on Type of SAQ’s.

  1. Service Providers PCI Compliance Levels:

Definition of Service Provider: Business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of other entity. This also includes companies that provide services that control or could impact the security of cardholder data. Examples like Hosting Service Providers, Card Printing Services, Backup Services Providers, Managed Service Providers, Security Management, Contact Centres and/or Back office Processing companies etc.,

Receiving a Report on Compliance (ROC) and validating as a Level 1 Service Provider allows entities to be on Visa’s Global Registry of Approved Service Providers. Which will help the entities recognized  as a Trusted service provider and useful for Pitching for the new business opportunities.

Guide to ISO/IEC 27701:2019 Clauses

Posted on by admin

The worldwide standard for a privacy information management system is ISO/IEC 27701. (PIMS). It is a privacy addition to ISO/IEC 27002 Security Controls and ISO/IEC 27001 Information Security Management.

These are some particular organisational roles:

  • PII controllers (among them are those who act as joint PII controllers)
  • PII processors

Following are the clauses mentioned in ISO 27701:

Clause 1: Scope

In here, the prerequisites for the management system’s intended use are outlined. As an addition to ISO/IEC 27001 and ISO/IEC 27002, ISO/IEC 27701 aims to provide rules and recommendations for setting up, implementing, maintaining, and improving a privacy information management system. focused on the individuals who are in charge of and accountable for handling PII, including PII controllers and PII processors.

Clause 2: Normative references

Documents cited in a standard are considered normative references. These include: ISO/IEC 27000 Overview and vocabulary for information security management systems ISO/IEC 27001 Information security management systems: requirements The ISO/IEC 27002 Code of Practice for Information Security Controls Framework for privacy established by ISO/IEC 29100

Clause 3: Terms and definitions

Important terminology used throughout the standard that are not defined in ISO/IEC 27000 and ISO/IEC 29100 are given a few extra definitions in this section.

Clause 4: General

In relation to ISO/IEC 27701, this clause “sets the scene.” It gives a high-level overview of the document’s organisation and identifies where the PIMS-specific requirements are located in reference to ISO/IEC 27001 and ISO/IEC 27002.

Clause 5: PIMS specific requirements related to ISO/IEC 27001

The purpose of this clause is to incorporate the protection of privacy into the information security criteria of ISO/IEC 27001 as well.

Determine your function as a processor and/or controller within the framework of the company, and take into account the influence of internal and external elements including privacy-specific rules and contractual requirements. Depending on your function, you must implement and apply the pertinent controls from Annexes A and/or B to your current statement of applicability.

Additionally, you must take into account the parties with an interest in the processing of PII, the scope of your PIMS, and the efficient implementation, upkeep, and ongoing improvement of the system. To ensure the protection of privacy, consideration and extension of ISO/IEC 27001’s requirements for management, planning, support, operation, performance evaluation, and improvement must be taken into account. Risks to information and processing of PII must now be evaluated and handled carefully, in particular.

Clause 6: PIMS specific guidance related to ISO/IEC 27002

This clause aims to expand ISO/IEC 27002’s information security recommendations to include privacy protection.

For instance, based on compliance, contractual, and stakeholder needs, enterprises need to take into account the extra implementation guidance regarding information security policies to incorporate pertinent privacy declarations.

Roles and duties in respect to the processing of PII are described with greater clarity. This includes being informed of incident reporting requirements and the repercussions of a privacy violation.

Advice is provided to guarantee that PII is taken into account while classifying your information. You must be aware of the PII your company handles, where it is kept, and the systems it passes through. Additionally, people need to know what PII is and how to spot it.

On incident management, removable media, user access on PII processing systems and services, cryptographic protection, reassigning PII storage space, back-up and recovery of PII, event log reviews, information transfer policies, and confidentiality agreements, more thorough implementation guidance is provided.

Additionally, this clause’s instructions encourage you to take PII into account before transmitting data over open networks and as part of the system’s development and design. Relationships with suppliers as well as their expectations and obligations must be addressed.

Clause 7: Additional guidance for PII controllers

This section deals with PIMS-specific implementation advice for PII controllers. It is associated with the measures detailed in Annex A.

For instance, in order to be in compliance with the laws that apply, you must specify the precise purposes for the PII you process and have a legal justification for doing so. If the intent behind processing PII evolves or expands, updates should be made.

Aside from these topics, the guidance also outlines contracts with PII processors, clear roles and responsibilities with any joint controllers, considerations of special category data and consent requirements, privacy impact assessment requirements to reduce risk to PII principals, and considerations of special category data and considerations.

People whose PII you process should understand why and how information is processed, along with a point of contact for inquiries. On consent, withdrawals, and PII access, correction, or deletion, specific instructions are provided. Additionally offered are third-party obligations, managing requests, and automated decision-making advice.

The accuracy and quality of PII, constraints on the amount collected based on the purpose of processing, and end of processing criteria should all be taken into account when implementing privacy by design for processes and systems. Importantly, PII sharing, transfer, and disclosure information is provided to assist you in moving your records between jurisdictions.

Clause 8: Additional guidance for PII Processors

This section addresses implementation advice for PII processors particular to PIMS. The restrictions indicated in Annex B are relevant.

For instance, in order to help customers meet their obligations, including those of PII principles, customer contracts should mention your company’s function as a PII Processor. To utilise PII data for marketing and advertising, prior consent is required.

There is advice provided on how to locate and keep track of the records required to prove compliance with the agreed-upon PII processing you carry out.

Detailed instructions are provided on how to assist your customer with specific requests, manage temporary files created during processing, return, transfer, or securely dispose of PII, and use the proper transmission controls.

In order to accommodate jurisdictional transfers, third-party and subcontractor requirements, and management of legally enforceable PII disclosures, thorough PII sharing, transfer, and disclosure guidance is provided.

Annexes

The ISO/IEC 27701 standard contains a number of Annexes. While annexes C–F contain additional information that can help with setting up and running an effective PIMS, annexes A and B are for controllers and processors, respectively. Following are covered in Annexes:

Annex A

An inventory of PII controller controls. A reason for any control that is excluded must be included in the statement of applicability even though not all controls will be necessary.

Annex B

An inventory of PII processor controls. A reason for any control that is excluded must be included in the statement of applicability even though not all controls will be necessary.

Annex C

Controls for PII controllers are mapped to the privacy principles in ISO/IEC 2900. This illustrates how compliance with ISO/IEC 27701’s requirements and controls relate to the privacy principles in ISO/IEC 29100.

Annex D

Articles 5 to 49 of the GDPR are mapped to the provisions in ISO/IEC 27701 (except 43). This demonstrates how fulfilling GDPR regulations might be relevant to conforming to ISO/IEC 27701 requirements and controls.

Annex E

Clauses in ISO/IEC 27701 mapped to:

  • Requirements for PII processors in public clouds under ISO/IEC 27018
  • ISO/IEC 29151 for guidelines and extra controls for PII controllers.

Annex F

Provides information on how to apply ISO/IEC 27701 to ISO/IEC 27001 and ISO/IEC 27002. It offers various application examples as well as a clear map of how information security words are extended to encompass privacy.

Controls Guide for ISO 27001 – Part 1

Posted on by admin

This article is part of our ISO 27001 compliance and certification hub page, created to help organizations understand the standard, its requirements, and its role in information security management. In this first part of the ISO 27001 controls guide, we explain the foundational controls that support risk management, data security, and a structured approach to protecting business-critical information.

An international standard called ISO/IEC 27001:2013 was developed to assist enterprises in managing the security procedures for their information assets. This standard offers a reliable framework for putting into place an ISMS, or Information Security Management System. Through its safe and efficient management procedures, this framework facilitates the Confidentiality, Integrity, and Availability of all crucial organizational data.

One of the most widely used and approved information security standards is ISO 27001. You can refer to our prior article for more information because we already covered everything you need to know about the ISO 27001 standard. The focus of this essay is on the ISO 27001 Audit Controls, nevertheless. The paper describes the ISO27001 Audit Controls in great detail.

What are the audit controls for ISO 27001?

There are two sections to the ISO 27001 Audit Control Standards.11 clauses, ranging from 0 to 10, make up the first section, which is the required element. 114 control objectives and controls are outlined in the second section, known as Annex A. The Introduction, Scope, Normative references, and Terms and Definitions of the ISO 27001 standard are covered in Clauses 0 to 3.

Any business that wants to be in compliance with the Standard must adhere to the ISO 27001 requirements listed in Clauses 4 through 10. The Standard’s Annex A provides a list of optional controls that are chosen as part of the Risk Management process to support these clauses and their requirements. 14 categories can be used to group the 114 controls in ISO 27001 Annex A, which we will explore below.

ISO/IEC 27001 Information Security Management Standard – Clauses 0 – 10

  1. Clause 0.1: Introduction  – The knowledge needed to put up a successful Information Security Management System is provided by the ISO 27001 Standard. This system provides an overview of how the standard implementation safeguards your data from unauthorized  users, complies with numerous national and international compliance standards, and inspires confidence in stakeholders and clients as a reliable business.
  2. Clause 1: Scope  – According to this clause, your organization’s context must be considered when applying the ISO 27001 standard’s specifications. So it’s crucial to understand your organizational  setting. This prevents you from overworking your system and attempting to accomplish goals that are unnecessary. It is stated again in the provision that your ISMS must apply risk management procedures. It also demonstrates how this norm applies to businesses of all sizes.
  3. Clause 2: Normative references  – This Clause exists to indicate that application of ISO 27001 requires ISO 27000. As a result, while developing your ISMS, you must read, comprehend, and apply the criteria of ISO 27000.
  4. Clause 3: Terms and Conditions  – The fact that all the criteria and conditions stated in this Clause also apply to ISO 27001 is another crucial reason why you should first grasp ISO 27000.
  5. Clause 4: Context of the organization  – This clause mandates that the organisation identify all internal and external concerns that might be pertinent to its business goals and the realization  of the ISMS’s own objectives.
  6. Clause 5: Leadership  – To ensure a seamless implementation of the ISMS, this clause mandates that top management duties be clarified, along with the roles and responsibilities and the contents of the top-level Information Security Policy.
  7. Clause 6: Planning  – The “preventive action” described in the previous version of ISO 27001:2005 is covered by clause no. 6. It lays out exactly what is needed in terms of risk assessment, risk management, Statements of Applicability, and Risk Treatment Plans, as well as how these fit together and make it easier to set up the ISMS.
  8. Clause 7: Support  – The next clause specifies that the organisation must establish and make resources necessary by the ISMS team to the team deploying the system available in order to achieve the specified objectives and demonstrate constant improvement. It aims to outline the prerequisites for resource accessibility, skill levels, awareness, communication, and document and record control.
  9. Clause 8: Operation  – This clause aims to guarantee that security goals are reached, risks and opportunities are handled appropriately, and information security regulations are adhered to. It outlines how risk assessment should be implemented as well as other procedures required to meet information security goals.
  10. Clause 9: Performance evaluation  – This clause addresses the ongoing measurement, analysis, performance assessment, and monitoring of the ISMS. These practices are critical components of an effective IS audit.  As a result, this Clause aims to provide precise measuring metrics by defining the standards for the organization’s monitoring, measurement, analysis, evaluation, internal audit, and management review.
  11. Clause 10: Improvement  – The requirements for nonconformities, corrections, corrective actions, and continuous improvement are outlined in this section.

Continue reading Here

How can SaaS companies benefit from ISO 27001?

Posted on by admin
Information security concerns are unavoidably sparked by the use of cloud environments. Users anticipate that the information they store—including sensitive, private, and customer information—will be kept secure. They want to carefully select a service provider so that they can rest easy knowing that their data is safe. As a result, it is envisaged that SaaS companies would be successful, reliable, and provide security measures.
The widely used international standard on information security management systems, ISO 27001, can be useful in this situation. Clients are reassured that the SaaS provider takes security and compliance seriously by the implementation of sufficient ISO 27001 procedures. There is a considerable likelihood that potential clients won’t even shortlist a SaaS provider if it lacks ISO 27001 certification.
The following reasons that ISO 27001 accreditation benefits SaaS Companies: 
  • Delivers systems and applications that are architected to be reliable and extremely secure.
  • By utilising the concepts of confidentiality, integrity, and availability, allows its users the freedom to own and control their data.
  • Complies with service-level agreements, ensuring the continuation of services and business
  • Outlines laws and other rules relating to information
The advantages of ISO 27001 for a SaaS Companies 
In addition to denoting trustworthy recognition, ISO 27001 for SaaS guarantees effectiveness inside a business, boosting customer retention and attracting new clients. Because of the following reasons, more SaaS organisations are attempting to get a competitive edge over their rivals by showcasing their dedication to data security:
  • Since they provide well-designed, trustworthy, and highly secure systems and apps, many businesses view ISO 27001 as a fundamental security criteria when choosing their SaaS vendor.
  • By implementing the principles of confidentiality, integrity, and availability, SaaS with ISO 27001 certification gives its users ownership and control over their data.
  • The risk management strategy of ISO 27001 enables SaaS providers to uphold their service-level agreements, ensuring SaaS customers’ access to services and business continuity in the event of an incident or disruption.
  • Identification of laws and other information-related legislation is required by ISO 27001. In order to give their clients peace of mind that their supplier is not exposed to any legal risk, ISO 27001-certified SaaS firms take this into consideration while creating their systems.
Certification criteria for ISO 27001 for SaaS Companies
A SaaS organisation must put in place a security framework and safeguards before applying for certification they are done in the 16 steps outlined in the following article: Checklist for implementing ISO 27001 The SaaS company will be qualified for the initial certification procedure after completing the implementation’s final steps, internal audit(s) and management review(s), and initiating corrective actions.
How is client data protection ensured by ISO 27001 certification? 
As previously noted, ISO 27001 provides a list of security measures that guarantee client data is safe. The following 14 sections are used to group these controls:
  • A.5 Information security policies: Policies instruct staff members and other parties about the key security principles and the goals an organisation hopes to accomplish with an information security system.
  • A.6 Organization of information security: Everyone will be able to understand their obligations and prevent conflicts in an organisation with well defined security positions. Additionally, establishing guidelines for using mobile devices and teleworking will lower the likelihood of violations.
  • A.7 Human resource security: Ensure that the organisation employs only dependable personnel who receive regular training and are aware of their obligations.
  • A.8 Asset management: Infrastructure, contracts, and database assets should all be categorized in an inventory and monitored for usage and any changes.
  • A.9 Access control: Make sure that permissions on who may access what information and how are handled in a secure manner because different customers or users will require different responsibilities.
  • A.10 Cryptography: SaaS data encryption is crucial because it ensures that data is protected from hackers and prying eyes while it is in storage or in transit. The best method to ensure data security is to use SaaS services that adhere to the necessary data encryption standards.
  • A.11 Physical and environmental security: It is essential to safeguard workspaces, rooms, and equipment. When choosing safeguards, one must take into account the location of the workplace, natural disasters, hostile assaults, cabling security, and equipment maintenance. SaaS businesses must have entrance limitations and safeguards against illegal access to information. Even small businesses with remote workers must have guidelines protecting their laptops, smartphones, thumb drives, and screen-clearing procedures.
  • A.12 Operations security: SaaS organisations must make sure they have enough capacity and the flexibility to make changes as necessary in order to fulfil client demand. Malware defence, backup administration, and recording of admin and user activity as well as security events are further operation security controls.
  • A.13 Communications security: In order to safeguard the data included in systems and apps, SaaS providers must monitor and regulate networks. SaaS applications must be protected by technical measures such firewalls, endpoint verification, network segregation, hosting, non-disclosure agreements, third-party extensions, and libraries.
  • A.14 System acquisition, development and maintenance: There should be specified guidelines that are applied to software and system developments within SaaS companies. Tests must be run to ensure everything is in order before going live.
  • A.15 Supplier relationships: SaaS organisations should only work with vendors who are aware of their security responsibilities.
  • A.16 Information security incident management: Prior to an issue occurring, SaaS organisations should build an incident management and response plan.
  • A.17 Information security aspects of business continuity management: When it comes to avoiding scenarios that will inevitably disrupt corporate operations, preparation is essential. The organisation will maintain control and lower disruption, damage, recovery time, and costs by defining important tasks and creating step-by-step procedures to resume regular operations.
  • A.18 Compliance: Laws and regulations must be followed by any corporate entity. SaaS businesses need to pay close attention to laws governing technical compliance, intellectual property rights, and privacy.
What role does ISO 27001 certification play in SaaS enterprises gaining market share? 
For SaaS businesses looking to gain international recognition and gain a competitive edge in a field that is expanding quickly and where security is the biggest problem, ISO 27001 is a fantastic place to start. Therefore, acquiring a new client will be considerably simpler if a SaaS company receives ISO 27001 accreditation.

Focus Areas of ISO/IEC 27001:2013

Posted on by admin

Information security management system ISO 27001 (formerly known as ISO/IEC 27001:2005) specification (ISMS). The legal, physical, and technical controls involved in an organization’s information risk management processes are all part of an ISMS, which is a framework of rules and procedures. For the purpose of “providing a model for establishing, implementing, operating, monitoring, reviewing, maintaining and enhancing an information security management system,” ISO 27001 was created, according to its literature.

Technology-neutral and top-down, ISO 27001 follows a risk-based methodology. A six-step planning procedure is outlined in the specification:

  • Define a security policy.
  • Define the scope of the ISMS.
  • Conduct a risk assessment.
  • Manage identified risks.
  • Select control objectives and controls to be implemented.
  • Prepare a statement of applicability.

The specification includes details for documentation, management responsibility, internal audits, continual improvement, and corrective and preventive action. The standard requires cooperation among all sections of an organisation.

The 27001 standards does not mandate specific information security controls, but it provides a checklist of controls that should be considered in the accompanying code of practice, ISO/IEC 27002:2005. This second standard describes a comprehensive set of information security control objectives and a set of generally accepted good practice security controls.

ISO 27002 contains 12 main sections:

  1. Risk assessment
  2. Security policy
  3. Organization of information security
  4. Asset management
  5. Human resources security
  6. Physical and environmental security
  7. Communications and operations management
  8. Access control
  9. Information systems acquisition, development and maintenance
  10. Information security incident management
  11. Business continuity management
  12. Compliance

Organizations must implement these measures correctly in accordance with their unique risks. For ISO 27001 compliance, third-party recognized certification is advised. Organizations must implement these measures in a way that is appropriate for their particular risks. For compliance with ISO 27001, third-party authorized certification is advised.

GDPR: When should you obtain consent?

Posted on by admin

Knowing how to obtain consent under the General Data Protection Regulation (GDPR) and when to do so might be challenging. Many individuals wrongly believe that organisations must obtain consent before processing personal data however, consent is simply one of six legal justifications, and you should only use it if all other options have been exhausted.

Other acceptable grounds include:  A contract with the person, such as one under which obligations under an employment contract must be fulfilled or goods or services must be provided as per their desire. When processing data for a certain purpose is required by law, compliance is required. Vital interests, such as protecting someone’s physical integrity or life (either the data subject’s or another person’s), are examples of vital interests. An official function or duty that serves the public interest is an example of a public task. This often applies to public institutions including government agencies, educational institutions, hospitals, and the police.

Legitimate interests: When a private-sector organisation has a true and legitimate reason (including a financial profit) to process a person’s personal data without their consent, provided that this reason does not exceed any detrimental consequences on the person’s rights and freedoms. You need to be aware of your responsibilities since there may be circumstances in which permission is the most suitable legal basis.

Opt In vs Opt Out

The GDPR specifies conditions for legitimate requests for consent, but consent must also be given with a definite affirmative response. In other words, rather than pre-ticked boxes, people need a method that demands a deliberate decision to opt in. The ICO (Information Commissioner’s Office) asserts that opt-out alternatives “are effectively the same as pre-ticked boxes, which are outlawed,” even though the GDPR does not expressly forbid opt-out consent.

Examples of demands for valid consent include:

  • Signing a consent statement on a paper form
  • Clicking an opt-in button or link online
  • Selecting from equally prominent yes/no options
  • Choosing technical settings or preference dashboard settings
  • Responding to an email requesting consent
  • Answering yes to a clear oral consent request
  • Volunteering optional information for a specific purpose (such as optional fields in a form)
  • Dropping a business card into a box

The issue is that in order for a request for consent to be valid, the person must clearly take an affirmative action. Consent requests must not in any way rely on silence, passivity, default configurations, exploiting indifference or inertia, or default prejudice.

Problems with consent :  Because individuals now have more control over their data under the GDPR, relying on consent can be risky and time-consuming. For instance, you will need to obtain everyone’s approval once more if you are processing personal data with their consent and later decide to use that data for a different purpose. You must delete from your files anyone who declines or doesn’t respond.

Furthermore, people have the right to withdraw their consent at any moment, which once again requires you to delete them from your database. If you don’t do this, the relevant supervisory authority may discipline your organisation.

Additionally, you may find yourself in a catch-22 situation if a data subject withdraws their consent and you later realize you are required by law to continue processing the data. In other words, you either fail to fulfil your legal obligation to handle the data or you are compelled to violate privacy law by processing the data after consent has been withdrawn.

Everything you need to know about HIPAA

Posted on by admin

Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law, mainly focused on protecting sensitive patient health information from being disclosed without the patient’s consent or knowledge. The law that provides baseline privacy and security standards for medical information of US citizens and included Administrative Simplification provisions that required HHS to adopt national standards for electronic health care transactions and code sets, unique health identifiers, and security

Healthcare information regulated by HIPAA is called protected health information (PHI). PHI is any demographic information that can be used to identify a patient. PHI can include a patient’s name, address, Social Security Number, insurance ID number, medical record, full facial photograph, and others.

HIPAA compliance involves fulfilling the requirements of the HIPAA of 1996, it’s subsequent amendments, and any related legislation such as the Health Information Technology for Economic and Clinical Health (HITECH) Act.

Applicability of HIPAA

Under HIPAA regulation, there are two classes of healthcare organizations that must be HIPAA compliant. These are:-

Covered Entity– A covered entity is a health care provider, a health insurance plan or a health care clearing houses whose activity is to creates, maintains or transmits PHI. Most health care providers employed by a hospital are not covered entities. The hospital is the covered entity and responsible for implementing and enforcing HIPAA complaint policies. Examples like

Business Associate– Person or business that provides a service to or performs a certain function or activity for a covered entity when that service, function or activity involves the business associate having access to PHI maintained by the covered entity. Examples like IT Managed Services, Hosting providers, Medical Transcription Services, Billing Services etc.,

HIPAA Rules:

Since HIPAA legislation passed in 1996, Department of Health and Human Services (HHS) added multiple Rules to protect patients Privacy and Security of the patients data.

HIPAA rules that require healthcare organizations — and their business associates — to protect patient privacy and secure patient data by ensuring technical, physical, and administrative safeguards are in place and adhered to, that they comply with the HIPAA Privacy Rule in order to protect the integrity of PHI, and that – should a breach of PHI occur – they follow the procedure in the HIPAA Breach Notification Rule.

HIPAA Compliance required on the following rules.

  1. Security Rule
    – Technical Safeguards
    – Physical Safeguards
    – Administrative Safeguards
  2. Privacy Rule
  3. Breach Notification Rule
  4. Omnibus Rule
  5. Enforcement Rule

The Security Rule sets national standards for protecting the confidentiality, integrity, and availability of electronic protected health information.

The HIPAA Privacy Rule governs how ePHI can be used and disclosed. In force since 2003, the Privacy Rule applies to all healthcare organizations, the providers of health plans (including employers), healthcare clearing houses and – from 2013 – the Business Associates of covered entities.

The Privacy Rule demands that appropriate safeguards are implemented to protect the privacy of Personal Health Information. It also sets limits and conditions on the use and disclosure of that information without patient authorization. The Rule also gives patients – or their nominated representatives – rights over their health information including the right to obtain a copy of their health records – or examine them – and the ability to request corrections if necessary.

Breach Notification Rule:

The HIPAA Breach Notification Rule sets standards for the process that covered entities and business associates must follow in the event of a breach. The HIPAA Breach Notification Rule requires covered entities to notify patients when there is a breach of their ePHI. The Breach Notification Rule also requires entities to promptly notify the Department of Health and Human Services of such a breach of ePHI and issue a notice to the media if the breach affects more than five hundred patients.

Omnibus Rule:

HHS enacted the  final Omnibus Rule  in 2013 to address policy gaps in earlier HIPAA rules. Most notably, the Omnibus Rule defines the role of business associates, which were not previously subject to HIPAA rules, and outlines the criteria for Business Associate Agreements (BAAs) which must be executed between organizations sharing PHI before any information is transferred, handled, or maintained.

Enforcement Rule:

The  Enforcement Rule  empowers HHS to enforce the Privacy and Security Rules. It gives OCR the authority to investigate HIPAA complaints, conduct compliance reviews, perform education and outreach, and  levy fines  of up to $1.5 million. OCR also works with the Department of Justice to refer possible criminal violations of HIPAA.  Read more about HIPAA Rules

Steps to became HIPAA Compliant:

  1. Implementing written policies, procedures, and standards of conduct.
  2. Designating a compliance officer and compliance committee.
  3. Conducting effective training and education.
  4. Developing effective lines of communication.
  5. Conducting internal monitoring and auditing.
  6. Enforcing standards through well-publicized disciplinary guidelines.
  7. Responding promptly to detected offenses and undertaking corrective action.

Need more insights ? Get in touch with our experts for any queries on HIPAA Assessment and Compliance.

What Is HIPAA Privacy Rule?

Posted on by admin

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a law in the United States that was created to ensure the privacy and security of health data. The Privacy Rule, also known as the Standards for Privacy of Individually Identifiable Health Information, is one of the most important parts of HIPAA. It defines how healthcare providers, health plans, health care clearinghouses  and other entities covered by HIPAA can use and disclose an individual’s protected health information (PHI). 

The act also covers health care providers that conduct certain health care transactions electronically. 

The Privacy Rule limits uses and disclosures to certain circumstances: 

–  To provide treatment, 
–  For payment, 
–  For healthcare operations, 
–  For public health activities, 
–  In specialized government functions such as military or intelligence purposes, 
–  For research purposes with consent, or 
–  If required by law. 

The Privacy Rule requires covered entities to provide individuals with notice about their privacy practices, including how they use and disclose their personal health information. It also limits certain uses and disclosures of this information without an individual’s written authorization. The key standards outlined by the HIPAA Privacy Rule cover:

– Patients’ rights to access PHI
– Health care providers’ rights to deny access to PHI,
– Contents of Use and Disclosure  HIPAA release forms
– Notices of Privacy Practices, and more. 

The Privacy Rule gives individuals rights over their protected health information, including the right to examine and obtain a copy. The Rule also gives individuals the right to request in writing that an organization restrict uses or disclosures of their protected health information.  

The regulatory standards must be documented in the organization’s HIPAA Policies and Procedures. 

10 Essential Requirements of GDPR summarized

Posted on by admin
This article is part of our GDPR compliance hub page, created to help organizations understand core GDPR obligations and compliance expectations. In this blog, we summarize the 10 essential GDPR requirements businesses should know, from lawful data processing and consent management to data subject rights, breach notification, and accountability in handling personal information.

It’s understandable that the General Data Protection Regulation (GDPR) is a difficult piece of law to comprehend. In this blog, we’ve offered a summary of the major GDPR regulations for individuals looking for guidance on how to comply.

1.  Lawful, fair and transparent processing
According to Article 5 of the GDPR, organisations must have a legal basis for processing personal data that is documented, and individuals must be aware of how their data is being used and processed. That might sound simple, but according to a research from our sister organisation, IT Governance UK, infractions of Article 5 are the most frequently mentioned mistake in penalty notifications. By comparing your procedures to the GDPR’s permissible bases for processing, you may make sure that your processing is legal (more on that later).
You must produce privacy notices and make them available to data subjects if you want to ensure transparency.
2. Limitation of purpose, data and storage
Article 5 also stipulates that businesses may only gather individuals’ personal information for specified purposes. They must also specify that objective in writing and make sure that data is destroyed when it is no longer required.
More latitude is granted for processing that is done for public interest archiving, scientific, historical, or statistical objectives.
3. Data subject rights
Eight data subject rights are protected by the GDPR:
  • Right to be informed
    People have a right to know what information is being gathered, how it will be used, how long it will be stored, and whether it will be shared with outside parties.
    This information must be delivered succinctly and in an understandable manner.
  • Right of access
    People can submit DSARs (data subject access requests), which compel organisations to give them a copy of any personal information they may have about them. Although there are few exceptions for demands that are plainly baseless, repetitive, or excessive, organisations have a month to produce this information.
  • Right to rectification
    An individual has the right to ask that any inaccurate or incomplete information held about them by an organisation be rectified. The same limitations apply as with the right of access, and organisations have a month to complete this.
  • Right to erasure
    In some situations, such as when the data is no longer required, it was improperly processed, or it no longer satisfies the legal basis for collection, individuals have the right to request that organisations delete their personal data.
  • Right to restrict processing
    When people no longer use the product or service for which personal data was originally acquired but the organisation requires it to establish, exercise, or defend a legal claim, they have an alternative to the right to deletion known as the right to restrict processing. The organisation should therefore restrict how the information is utilized rather than delete it.
  • Right to data portability
    People are free to collect and utilize their personal data anyway they see fit across various services. This right only applies to personal information that a person has voluntarily or contractually disclosed to data controllers.
  • Right to object
    Organizations must provide individuals with the opportunity to object when processing personal data on the grounds of legitimate interest or carrying out a duty in the service of an official authority. Organizations must stop processing information if they exercise this right, unless they can provide a compelling cause for doing so that outweighs the interests, rights, and freedoms of the individual.
  • Rights related to automated decision making including profiling
    The GDPR has protections for decisions that are made automatically, like profiling, which analyses personal data to infer judgments about people. There are strong regulations governing this type of processing, and individuals are free to contest the processing and ask for a review if they think the regulations aren’t being followed.
4. Consent
It’s a common misperception that organisations must obtain individuals’ consent before processing personal data under the GDPR. In reality, there are only six legal reasons for permission, and it should only be used in certain circumstances. Organizations must adhere to specified guidelines when consent is most appropriate.
In essence, consent must be expressed through an obvious affirmative action. In other words, rather than pre-ticked boxes, people need a method that demands a deliberate decision to opt in.
5. Personal data breaches
Understanding exactly what is covered in this word is crucial because data breaches are at the core of the GDPR. An incident that results in the unintentional or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed is referred to as a personal data breach in Article 4.
This implies that data breaches aren’t necessarily the consequence of hackers breaking into a company’s computer systems. They can also happen when an employee accesses data that are unrelated to their job function, shares files with a third party outside the organisation, or sends an email with sensitive information to the incorrect recipient. Data breaches also include incidents like ransomware attacks or broken hardware that prevent organisations from accessing systems that contain personal data because it is no longer usable.
6. Privacy by design
Privacy by design is not a new idea it was previously regarded as best practise. With the GDPR, it is now required, though.
So what is it exactly? It asserts that organisations should take privacy concerns into account before implementing data processing procedures rather than doing so after the fact.
This requires organisations to:
  • Implement the right organisational and technical steps to put the data protection principles into practise
  • integrate safeguards to abide by the GDPR’s standards and protect the rights of individuals.
7. Data protection impact assessment
Article 35 introduces DPIAs as a concept (data protection impact assessments). These aid organisations in identifying and reducing privacy issues when processing data. They are crucial if you handle any high-risk data, but they are also important whenever you’re implementing a new system, procedure, or technology for data collection. DPIAs are required, according to the GPDR, in situations when processing data “is likely to result in a high danger to the rights and freedoms of natural persons.”
Although it doesn’t define “high risk,” it typically refers to the following:
  • Broad and systematic profiling
  • Large-scale statistics on a specific category or offence
  • large-scale, systematic observation of locations that are open to the public
8. Data transfers
Depending on where you are moving data to and from, different rules apply for data transfers. Organizations do not need to take any additional security precautions when transferring personal data inside the EU. However, one of the protections listed in Article 46 must be used if you are sending data to a third nation. SCCs (standard contractual clauses) are used in the majority of situations where organisations are straightforwardly sharing data with organisations headquartered outside of the EU. Two sets of SCCs for data transfers between data controllers and one set for data transfers between data controllers and data processors have so far been released by the European Commission.
9. Data protection officer
A DPO (data protection officer) is an impartial expert in data protection who advises a company on how to adhere to regulatory standards. Article 39 lists the prerequisites for a DPO, which include the following :
  • Educating employees about their obligations regarding data protection
  • Maintaining a close eye on the organization’s data protection rules and practises
  • Advising management of the necessity of DPIAs (data protection impact assessments)
  • Acting as the organization’s point of contact with its supervisory authority
  • Acting as a contact for people with regard to privacy issues
10. Awareness and training
Anyone who manages personal data or is in charge of monitoring data protection procedures must provide staff awareness training. Additionally, make sure that the training is applicable to the work that the personnel do. For instance, employees in charge of handling personal data should be educated about their duties and the risks involved. Along with the data protection policy, senior staff members should be taught key concepts, including privacy by design and DPIAs.