Personal and sensitive data held by organisations, large and small, public and private, is under constant threat. In the UK, companies that collect and process personal data are regulated by the Information Commissioner’s Office (ICO), who enforces the Data Protection Act 2018 and the EU General Data Protection Regulations (GDPR). All countries are tightening rules for protecting data.

“Personal data” and “sensitive personal data” are within the GDPR. “Personal data” is a complex category of information, meaning, broadly, information which can be used to identify a person, for this example, his name, address or IP address. “Sensitive personal information” includes, for example genetic data, and information about religious and political views and sexual orientation. Pseudonymised personal data is now included.

It is the duty of data controllers and processors to implement technical and organisational measures proportionate to the threats to the data, and the risks involved in the nature, scope and context of processing. The costs of protection must be balanced against the potential damage to data, and the penalties regulators might impose for beaches of the law. Controllers and processors must be aware of the importance of pseudonymisation and the encryption of data. They must maintain: (1) systems to protect the integrity availability and integrity of processing procedures and service; and (2) mechanisms which ensure the regular testing and evaluation of these systems and their efficiency.

Problems in the industry