Data protection and data security
Data protection is about how personal data is used and about respecting privacy. Data security covers the technical and organisational measures that protect data from unauthorised access, loss or destruction. You cannot have one without the other.
Responsibility is shared: companies and organisations that collect and process data must protect it, and everyone must also look after their own.
What is personal data?
It is any information relating to an identified or identifiable individual, directly or indirectly. For example:
- name, address, email address, phone number, age;
- social security, tax or passport number;
- bank details and card numbers;
- health data;
- photos and videos in which a person can be recognised;
- IP address, location data, browsing history.
Some data, known as sensitive data (ethnic origin, political opinions, health…), is given stronger protection.
What the GDPR requires
In France, as across the European Union, the General Data Protection Regulation (GDPR) has applied since 25 May 2018. The French Data Protection Act supplements it, and the CNIL, the French data protection authority, enforces these rules. The GDPR’s key principles:
- Transparency: tell people clearly what data is collected and how it is used.
- Lawful basis: every processing activity relies on a basis set out in the regulation, such as consent, a contract or a legal obligation.
- Purpose and minimisation: collect only what is needed, for a specific purpose.
- Limited retention: do not keep data longer than necessary.
- Integrity and confidentiality: protect data against loss, theft or misuse.
- Individuals’ rights: access, rectification, erasure, portability, objection.
- Data breaches: report them to the CNIL within 72 hours when they pose a risk, and inform the people affected if the risk is high.
- Privacy by design and, in some cases, appointing a data protection officer (DPO).
Ten habits to protect your data
- Strong, different passwords for every account: that way, one hacked account does not give access to the others.
- Two-factor authentication wherever it is offered.
- Caution on public Wi-Fi: use a VPN instead.
- Software and systems that are always up to date.
- Wariness of phishing: no clicking on unexpected links, never giving a password by email or text message.
- Care before installing an app or software: check what data it collects and the permissions it asks for.
- Privacy settings adjusted on your social media, browser and operating system.
- As little personal information online as possible: share only what is needed.
- Online storage chosen with care: encryption and good security practices at the provider.
- Your own chargers: avoid public USB charging points, which can be used to access a phone’s data.
In business: ransomware targets your data
Cybercriminals no longer just encrypt a company’s data: they also threaten to publish it unless a ransom is paid. A few essential measures:
- Regular backups, including an offline copy disconnected from the network.
- Regular security checks to find and fix weaknesses early.
- Staff awareness, especially about emails and attachments.
- Access control: everyone accesses only the information they need.
- Encryption of sensitive data.
- Monitoring and logging, to spot unusual behaviour.
- Not paying ransoms: paying makes you a prime target.
If an incident happens, call on an IT security expert: they can help you repair the damage and strengthen your security for the future.