The General Data Protection Regulation (EU) 679/2016 (‘GDPR’) will be, as of 25 May 2018, the main data protection legal framework in EU directly applicable to all Member States, repealing the current Data Protection Directive 95/46/EC. Currently, businesses in the EU have to deal with 28 different data protection laws. This fragmentation is a costly administrative burden that makes it harder for many companies, particularly SMEs, to access new markets. One of the core obligations for all businesses, including SMEs, acting either as data controllers or data processors, in GDPR is that of the security of personal data. In particular, according to GDPR security equally covers confidentiality, integrity and availability and should be considered following a risk-based approach: the higher the risk, the more rigorous the measures that the controller or the processor needs to take (in order to manage the risk). Even if this risk-based approach is not a new concept only a few specific privacy risk assessment frameworks have been presented, focusing principally on the evaluation of risks to personal data and adoption of relevant security measures. On this basis and as part of its continuous support on EU policy implementation, ENISA published in 2016 a set of guidelines for SMEs , acting as data controllers or processors, which aim at helping them assess security risks and accordingly adopt security measures for the protection of personal data. Those guidelines can also be of use in all cases where risk assessment is envisaged under the Regulation (e.g. Data Protection Impact Assessment, personal data breach notification, etc). Within 2017 the Agency continued its activities in the area and focused on providing further guidance on the application of the aforementioned guidelines through specific uses cases. In close collaboration with experts from national Data Protection Authorities, each use case corresponds to a specific personal data processing operation and makes specific assumptions on the data processing environment and overall context of processing. The provided examples however focus only on security measures and do not aim at providing any legal analysis or assessment of compliance with GDPR for the specific data processing operations.
PDF file, 68 pages