5 ways to reduce your GDPR risk

Every year, new technologies emerge which put us all at greater risk of online data breaches. But, as we know, human error is the biggest cause of data breaches – responsible for over 90 percent.Research carried out by Hayes Connor at the end of 2020 illustrates the point. It showed that one in five UK office workers did not receive appropriate GDPR training and data protection guidelines, putting UK companies at serious risk of a breach.Whether it be falling victim to phishing emails, leaving documents lying around, or sending an email to the wrong person, it is easy for basic, avoidable mistakes to cause breaches with potentially huge consequences. So, how can you, as a senior security lead, make sure your staff are best equipped to avoid making costly errors? Here are five top tips:Start with the basics Many of us believe that malicious hackers and scammers are the biggest threat to our personal and company data. In fact, it is your employees’ lack of understanding of basic GDPR principles.Our data breach survey uncovered that many employees – even those at a senior level – had never heard of the Information Commissioner’s Office (ICO). People are lacking the basic knowledge, which means they are likely to have minimal to no understanding of the risks they are facing every day.So start simple by training staff on the basics: teach them about GDPR principles and the risks of not complying. Understanding these risks opens eyes and makes employees hyper-aware, increasing vigilance on everyday tasks.Email etiquette So, ‘simple’ works, and the simplest way to avoid human error data breaches in the workplace is by putting a huge emphasis on email etiquette. Here are some rules:Do internal test emails before any external marketing emails are sent Double-check all email attachments are correctCheck and double-check all correspondence before any is sentMake appropriate use of BCC to make sure recipients can’t see the email addresses of other recipients Learn to recognise malicious email For example, at the beginning of lockdown, Watford Community Housing Trust suffered a massive data breach, one that simple email etiquette may have avoided. In March 2020, a senior employee from the customer relationship team sent out a COVID-19 update email to more than 3,000 tenants. It detailed the operational and communication measures they were implementing during the pandemic. They used a software communication application to do so, but a file with a spreadsheet containing the personal data of over 3,500 tenants was attached in error. Training and sticking to basic email principles dramatically reduces the risk of such breaches.Proper tools for a proper jobA glaring statistic within the data breach survey was that two thirds of home workers who printed off work documents threw them in the bin after use – meaning passers-by could stumble across this information. This is a data breach.We have acted for a claimant where this situation led to a data breach claim. Documentation relating to a vulnerable person was found partially ripped and discarded in a communal bin outside the employee’s accommodation. The document included personal and sensitive information, alongside an image. It is important that employees have the necessary tools to maintain good data practices while they are working remotely: a shredder to dispose of printed documents safely and a laptop to avoid the need to print off documents in the first place. Consider t hese small investments now before a costly breach hits you down the line.Data protection when out and about Face to face meetings may be on hold, but when they return employees must be trained on dealing with sensitive documents when they are not in the office.We acted for a client whose medical records were left by a medical practitioner in another patient’s house during a home visit. After they realised the documents had been left, they told them they would come to collect them when they were next out visiting that particular patient, rather than immediately. We recovered £6,500 for our client.In this case, the practitioner clearly had no comprehension of the data-breach risks posed. Travelling to and from client offices puts your employees in similar positions. Make staff aware of these risks through training, and by ensuring they keep all documents on them at all times.Employees must rectify the situation as soon as they realise, not leave it till the next visit! It’s these very simple steps that need to be emphasised to staff during training sessions.The when and how of data protection softwareAny responsible company owner should implement encryption, multi-authentication password settings, and have a secure network as a bare minimum. This protects important documents as much as possible from back-end hackers.That said, there’s no use in having this software if employees aren’t aware of how and when to use it. Part of your company training should focus on what safety nets you have in place, and how and when to use them.You also need to teach employees what to do if this software fails and the key processes and safeguards to rectify the situation if it does.It’s the simple things that matter most…As you can see, it’s not the complex cyber security software that needs to be considered – although this is also key – it is the very basic processes that need attention. It is these often neglected protocols that are the greatest causes of data breaches. If you have been a victim of a data breach, the team at Hayes Connor are happy to help.

Your cyber intelligence source

5 ways to reduce your GDPR risk

Related content

The Case For Automated Network Security Policy Management

OpenAI Fined Over GDPR Failings

Out of Band Patches Released by Adobe Vulnerability

API Flaw Saw McDonald's Driver and Customer Information Vulnerable

LLM Could Generate Thousands of Malware Variants

The Interrelationship Between Cybersecurity and Business Resilience: A New Policy Imperative

Phishing Messages Used DocuSign as a Lure

Upcoming Events

5 ways to reduce your GDPR risk

Related content

The Case For Automated Network Security Policy Management

OpenAI Fined Over GDPR Failings

Out of Band Patches Released by Adobe Vulnerability

API Flaw Saw McDonald's Driver and Customer Information Vulnerable

LLM Could Generate Thousands of Malware Variants

The Interrelationship Between Cybersecurity and Business Resilience: A New Policy Imperative

Phishing Messages Used DocuSign as a Lure

Upcoming Events

Confirm cancellation

Sign up benefits