Data breaches—have you identified your risks yet?

Nearly half (47%) of these data breaches involve personal data sent to the wrong recipient; for example, an email sent to the wrong email address. About 15% involve lost personal data, which can result, for example, from a stolen or lost laptop, a bag containing files, or a USB drive left lying around. The majority of data breaches involved the leakage of name, address, and contact information, gender, date of birth, and social security number.

Information security is therefore becoming increasingly important. The dangers posed by hackers and other malicious actors are well known, but often not enough is being done to address data leaks caused by human error or carelessness. Just think of all the data stored in the public cloud or the sending of confidential documents via email that might end up in the wrong recipient’s hands.

More than 90% of Europeans have indicated that they want the same data protection rights throughout the EU, regardless of where their data is processed (source: EC). The European Union has therefore implemented new measures to prevent data breaches by amending existing laws on information security and privacy at the European level. The key piece of legislation is the General Data Protection Regulation, or GDPR, which has been in effect since May 25, 2018.

The law applies to all organizations within the EU, as well as to organizations outside the EU that process personal data of EU residents. As a result, organizations are required to report to only one data protection authority, even if they have offices in different EU countries. However, the GDPR does require organizations to be able to demonstrate that adequate measures for protecting personal data have been implemented. They must also, as is currently the case, report data breaches to the Dutch Data Protection Authority. In some cases, individuals whose data has been compromised must also be notified.

Fines for noncompliance with these rules can amount to 820,000 euros or 10% of annual revenue.

With the tightening of privacy laws, implementing a well-thought-out cybersecurity strategy should be a top priority for organizations—especially for those that process large amounts of personal data. In addition to the hefty fines resulting from a data breach, you’re also always at risk of reputational damage (with all the consequences that entails!).

It is therefore important to do everything possible to minimize the risk of data breaches. If you do not yet have a cybersecurity strategy (or if it is no longer up to date), it is advisable to get started on this right away.

• Do you know how to get started with this?
• Where do your risks lie when it comes to the security of business information?

To get started with your cybersecurity strategy, you must first gain insight into the threats currently lurking within your own organization.