GDT Webinar Series – How to Fail at Security? Reserve Your Spot

Are You Ready for GDPR?

GDPR

by Moe Janmohammad, GDT Cybersecurity Analyst

On May 25th, the new General Data Protection Regulation (GDPR) from the European Union (EU) will go into effect. The regulations are designed to protect the data of EU citizens, and penalties for non-compliance are steep (up to the greater of 20 million Euros or 4% of total gross revenue).  Even if your company isn’t based in the EU, the regulations could still affect your information security policies. To help you better prepare your IT Security teams, here are the questions you should be asking yourself these 4 questions:

  1.  What is defined as personal data?

The GDPR has definitions of what personal data consists of, which includes “an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” While IP addresses are not specifically included, they do include geolocation and provider information that could potentially be used to identify individuals. You’ll need to determine what data you’re currently holding.

  1. Where are we storing personal data?

Twenty years ago, personal data was stored in a corporate data center. Today, that data can be stored on edge devices, mobile devices, on-premise servers, or even the public cloud. Data in 2018 is extremely mobile and fragmented. Your IT team must have full visibility into where the generated data is being stored. If you don’t have this information, you might have a problem.

  1. Who can access the personal data?

GDPR restricts data usage strictly covered by the initial consent agreement. And if you share that data with a third party, it is your company’s responsibility to ensure they are only using the data for the purpose covered by the initial consent. You need to know who is accessing the data and what they’re doing with it, even if they are from outside your organization.

  1. How do we ensure it is protected?

This is the hardest question to ask, as solutions get expensive quickly. A large number of data breaches begin with stolen credentials. Monitoring end user behavior for anomalies can help identify risk and provide early warning signs for a potential data breach. Automated defenses can be set up to revoke read/write access for potentially compromised users, or for sinkholing their outbound traffic to prevent exfiltration.
Asking yourself the aforementioned questions is important, but being able to address and answer them is vital. If you can’t, you might be setting your company up for an expensive penalty.

Author

Share this article

You might also like:

The Cisco True Forward: How to avoid surprise costs

It started with an invoice they didn’t expect—$280,000 in unbudgeted costs tied to licenses they didn’t even know they were overusing. That was the moment this healthcare provider realized how important Cisco True Forward visibility really is. And they’re not alone.  For organizations that rely on Cisco to power critical

Salt Typhoon cyberattack

In a January 2025 advisory, CISA’s then-director, Jen Easterly, stated that “China’s sophisticated and well-resourced cyber program represents the most serious and significant cyber threat to our nation, and in particular, U.S. critical infrastructure.” Whether they aim to spy, disrupt, or destroy, safeguarding infrastructure against Salt Typhoon cyberattacks and other

How weak data governance, security, & identity management thwart AI transformation

AI has the potential to bring significant changes to business. However, AI initiatives are often hindered by issues related to AI data governance, security, and identity management. While data concerns and identity management are not the only things slowing down AI initiatives, they are among the largest roadblocks to an