Category: Certification

GDPR Compliances for an Indian Companies

Posted on by admin

The European Union (EU) is known for its strict regulations when it comes to data privacy and information security. The systems need to comply with their guidelines in order to function in the EU. Recently, the EU has introduced a set of regulations for the protection of data processing and free movement of data pertinent to natural persons residing in the EU. These regulations are known as the GDPR and are it has extraterrestrial applications. Which means that any entities processing or moving the data of the EU residents need to comply with the GDPR. This has far-reaching implications for foreign entities such as Indian companies in the data processing space.

The impact of GDPR on Indian companies is profound. The Information Technology industry in India is widespread and a large number of companies find themselves in a place where they need to comply with the GDPR to conduct transactions with the EU. So let us take a look at what Indian companies need to achieve in order to work with EU residents in the data sector.

The EU explains GDPR as, “The General Data Protection Regulation 2016/679 is a regulation within the European Union and the European Economic Area that pertains to data protection and privacy for all individuals. It also identifies and addresses the export of personal data outside the EU and EEA areas.”

Here, ‘personal data’ refers to the information related to an identified or identifiable natural persons. Which means any entity with an identification, security numbers, genetic identification, or any specific form of identification is considered a natural person. So any information pertaining to a natural person who is a resident of the EU is considered personal data under the GDPR.

For any foreign entity, such as Indian companies, dealing with the personal data of the EU residents, it is imperative to ensure that their systems are compliant with the GDPR norms and the data protection requirements are in place. This means that most Indian companies need to redefine their privacy policies and bring about certain pertinent changes in their system.

Also Read –  5 ways to remain GDPR compliant in 2019

It is not only important but lawfully stipulated that companies comply with the GDPR stipulation as the penalties for non-compliance are severe in the EU law. It can prove to be an invitation to penalties up to 10,00,000 to 20,00,000 euros or 2-4% of the global turnover of the previous financial year, whichever is higher. Most EU companies insist on  GDPR compliance  as a standard contractual clause so as to ensure complete security of their data. Indian Government is also looking at updating and introducing laws to ensure stronger data protection compliances and guidelines for Indian Companies. Meanwhile, it goes without saying that any company in India which is looking at working with the EU needs to update its data protection policies in order to continue its business transactions. Currently, the trends in the GDPR compliances beg the question of how Indian companies are preparing for this switch. For this, the following questions need to be pondered upon-

  • What is the data footprint of Indian companies in EU?
  • Are Indian companies equipped and prepared to provide evidence of GDPR compliances to the stakeholders who may request them ?
  • Do Indian companies have a holistic understanding of what data is collected and how it is used and processed?
  • Is there a defined roadmap for GDPR compliances?
  • What cross border data transfer strategies are we adopting as Indian organizations?

In a recent seminar titled, GDPR: Post Implementation Review, the following points were discussed to make the compliances more relevant-

  • Global Privacy Challenges: The seminar addressed global security challenges beyond GDPR and addressed the fact that while GDPR is important, it not an answer to all problems. Given the recent developments in countries like Brazil and India, the companies recognized privacy as the new normal, and decided to work to build efficient programs to address privacy challenges.
  • Maintaining a Culture of Privacy Awareness: A key concern for most business is to maintain a culture of privacy in their organizations. Because of how some people view GDPR as a checklist to be completed rather than an ongoing responsibility, this concern was discussed at length.
  • Territorial Scope: Various companies struggle to identify the territorial scope of GDPR given that it only applies to EU residents. However, a lot of North American businesses now abide by GDPR as a company policy rather than a mandate for EU.
  • GDPR and Future Privacy Challenges: With the advent of Ai, Machine Learning and Big Data, companies have struggled to interpret the application of GDPR in the global scenario.   This discussion lead to the future challenges of GDPR that will require innovative solutions.

While this may seem like a lot of information, the right guidance can help you with these compliances. QRC solutions has a team of experts who guide and help you acquire the  GDPR certification  without much hassle.

PCI DSS Guidelines To Combat Against Card Skimming

Posted on by admin

According to The Payment Card Industry Data Security Standard (PCI DSS), businesses carrying out their transactions online are mandated to maintain certain guidelines in order to safeguard the interests and data of their users. These guidelines combat various issues such as data theft, hacking, fishing, and even card skimming.

Card skimming is the theft of credit card data by attaching external devices to card reading devices in the public and covertly stealing the card data and passwords for later use. This is a form of credit card fraud as these people monitor legitimate credit card transactions and steal the credit card information by the use of small external devices such as cameras or scanners. Usually, all of this data is stored in a plastic card’s magnetic stripe. The devices used for skimming or theft of the credit card data are known as card skimmers. These skimmers are a form of cameras or scanners which are placed over the card readers of public card machines or ATMs, and when any transaction is carried out, they record the card details and passwords in another plastic card via the magnetic stripe and clone the credit card. This way, they can use a credit card without the consent of the owner.

In order to avoid incidences of card skimming, the PCI DSS has requirements in place which give instructions on how to avoid incidences of credit card fraud.

The  Requirement 9.9  in PCI DSS standards for security against physical access, that explicitly states, “Protect devices that capture payment card data via direct physical interaction with the card from tampering and substitution.” Which implies that businesses require to ensure that their card reading devices need to be protected and monitored from tampering of any kind and special attention needs to be paid to ensure that there is no substitution of devices of any sorts.

In detail, the Section 9.9  asks businesses to make a list of all the devices they own, inspect the devices frequently, and train the security personnel to detect and be aware of suspicious behaviour. These guidelines are recommended but not mandatory. However, given the recently increased instances of criminals using skimmers to steal credit card information, it is strongly advised that businesses take PCI DSS recommendations very seriously.

Recently, there have been various instances of card skimming where criminals have been caught with hundreds of cloned credit cards and skimming devices to further their crimes. A couple of Romanian criminals was recently caught by the police with an external skimming device attached to a public ATM in New Delhi, along with a small camera and various plastic cards. They intended on recording the passwords of the credit cards as they were entered and then entering all of this information on the plastic cards that they owned. Thankfully, these criminals were arrested before they could cause any problems. PCI DSS allows a framework to businesses to ensure that they are protected from such theft and criminals who skim credit card data. These guidelines are key to secure and safe transactions without having to worry about any kind of theft or fraud.

QRC Solutions allows you to ensure the  PCI DSS compliances  in order to ensure that your business is safe against card skimmers. With the guidance of the experts, it is imperative that your business will be secured from any credit card frauds that may occur.

5 Ways To Remain gdpr Compliant In year 2019

Posted on by admin

GDPR compliance has been one of the most talked about changes over the last couple of years. Even though the deadline was in May 2018, it is obvious that investment in the compliance is a continuous process. In fact, reports even suggest that investments over the next 14 years could go up to $2.1Billion. It is also important to note the risks in case you are not compliant are quite expensive also and could be one of the reasons that many organisations are looking to implement it into their business.

So, if you are looking at getting  GDPR certification  into your business, how do you go about it? What do you have to keep in mind when you want to follow these guidelines in your company?

  • Automation Technology:  Investing in automation is key for every business today, precisely because it manages costs better, improves quality and ensures consistency throughout. With mammoth data in place for most companies, you need automation to keep track of all this data. You need to know where and how the data you have can be adapted and processed – this is where artificial intelligence comes to play. You would be able to break down data so much easier and that makes all the difference to your business at the end of the day.
  • Required privacy laws and data governance:  Before you look at implementing a compliance in your business, it is critical to understand why you have to implement it as well as the governing rules you need to follow. Creating a set processes of all that is done is the simplest way to implement every kind of compliance. Plus, keeping it as a mandate would only help.
  • Where is your data moving?  There’s a lot being said about data lineage today and that makes perfect sense when you are implementing this kind of compliance – you need to know where your data is transformed over the course and where it is stored.
  • Maintenance of data:  The main goal of GDPR certification is to ensure that any individual has control over their personal data. If your business is becoming GDPR compliant, it is important to understand what data is working towards keeping the data safe. It is vital to store the data that is absolutely important for the running of the business to keep risk away.
  • Looking at the bigger picture:  You need to constantly look at the value you are getting by being compliant to GDPR – this will reduce direct costs and create an efficient audit ecosystem. You would be able to manage & track the information that is passed on throughout the system and thus be able to track and make important business decisions.

While there would be an initial investment to being your business on board – you need to look at the bigger picture and see the return on investment at every cycle. There is no doubt that a compliance of this kind will give your business a chance to thrive.

HIPAA and Data Sharing Resharing Both For Digital

Posted on by admin

Understanding the costs that are linked with delivering great service levels in the IT industry is extremely important in the healthcare industry today. Among all aspects of the IT industry, data security probably ranks as #1 in the priority list. The simplest way to keep your data safe in the IT industry is by following  HIPAA compliance  – The Health Insurance Portability and Accountability act sets the standard for sensitive patient data protection and ensures that companies which have protected health information secure their physical network and keep all possible security measure.

Any entity that provides treatment, payment or any form of operation in healthcare have to meet this compliance as a mandate in the USA. Over the last few years, we have seen how cyber security has been the strongest point of threat for several businesses and any form of leakage or damage can be critical. It can in fact bring the entire business down permanently.

What are the right measures you can take to protect data?

The information that you possess are stored as emails, databases, library files etc and can there maybe several data access points for this. The biggest threat lies in the fact that this data is to be backed up and stored. Now, most of these companies do not protect their SaaS data with a backup or a recovery solution leaving them prone to troubles in case of a server failure or hacking or even malware. This is a huge threat – as  the data can be hacked into easily.

When you follow HIPAA compliance– you are completely sure of having this data protected by having your data backed up. Some of the most common practices to follow   in  HIPAA certification  are

  • Create policies on using and accessing workstations, electronic media as well as data access points.
  • Having a policy in place to ensure there are restrictions for transferring, deleting or adding data using any form of electronic media.
  • Ensuring there is no transferable data devices that could be used in the premises.
  • Having access control lines across the floor as well as towards the data that is present via the network.
  • Enabling unique user Ids, emergency access procedures, auto log off sessions, encryption and decryption of data.
  • Tracking those who access was granted to and random checks of the details looked at. Auditing or tracking logs on hardware as well as software platforms.

It is also mandatory to have integrity controls and measures to make sure that the data is destroyed. Having an IT disaster recovery team will ensure that any failures this kind can be rectified immediately and that patient health information is recovered accurately. Many outsourcing companies put these compliances as a mandate for all their projects as a security guideline. So, if you are in the space that looks at getting work from corridors in the healthcare industry, it makes perfect sense to have this compliance instilled in your organisation.