Data protection and cyber security are often talked about together. But they’re not actually the same thing.
Data protection is concerned with how organisations collect, use, store and share personal information.
Cyber security is concerned with protecting systems, networks, devices and information from cyber threats and unauthorised access.
So why are they so closely connected? Because the technology a business uses plays an important role in protecting the personal information it holds. The ICO’s new Data Protection Essentials programme highlights reducing the risk of data breaches as one of the areas smaller organisations need to understand.
That makes this a good opportunity to look at the relationship between the two.
Data Protection Doesn’t Automatically Mean Cyber Security
A business could have a privacy policy, appropriate data protection processes and employees who have completed training, but still have significant weaknesses in its IT security.
Equally, having strong cyber security controls doesn’t automatically mean an organisation is meeting every data protection requirement. They’re different disciplines. But they need to work together.
For example, if your business stores customer information in Microsoft 365, from a data protection perspective, you need to think about how that information is collected, used, retained and shared. From a cyber security perspective, you need to think about things such as:
- Who can access the accounts?
- Are strong authentication controls in place?
- Is multi-factor authentication enabled?
- What happens if an account is compromised?
- Are devices accessing the information secure?
- Can information be recovered if it is lost or encrypted by an attacker?
The two perspectives are different, but the same information is involved.
Five Areas Where IT and Data Protection Overlap
- Access controls
Not everybody in an organisation needs access to everything. Good access controls help ensure that employees can access the information necessary for their role without unnecessarily exposing other information.
The ICO’s practical security guidance specifically recommends limiting access to those who need it and reviewing access when employees leave or are absent for extended periods.
- Multi-factor authentication
Passwords alone aren’t always enough to protect important accounts. Multi-factor authentication adds another layer of protection by requiring an additional form of verification.
The ICO recommends considering MFA as part of keeping systems and personal information secure. For SMEs, enabling MFA on important business accounts can be one of the most straightforward security improvements available.
- Backups
If important information is lost because of hardware failure, accidental deletion or a cyber attack, can you recover it? Backups are therefore important for both business continuity and information security. But having a backup isn’t enough. It needs to be appropriately protected, regularly performed and, importantly, tested.
The ICO advises businesses to back up data regularly and make sure backups aren’t exposed to the same malicious activity as the live data.
- Employee awareness
A technically secure environment can still be undermined by an employee clicking a convincing phishing email or accidentally sharing confidential information. This is why training matters.
The ICO’s new Data Protection Essentials programme provides bite-sized training for employees, while wider cyber security awareness should help people recognise threats and understand what to do when something doesn’t look right.
- Incident response
When something goes wrong, speed matters. The longer an organisation takes to identify and respond to a compromised account, lost device or potential data breach, the greater the potential impact can be.
Businesses should know:
- Who is responsible for handling incidents
- How employees report problems
- How accounts or devices can be secured
- What information needs to be recorded
- When specialist advice may be required
Having a plan before an incident happens is considerably better than trying to work out what to do during one.
So, Where Should an SME Start?
The ICO’s Data Protection Essentials programme is a sensible place to start because it provides a structured introduction to data protection and includes a self-assessment to help organisations identify areas for improvement.
From there, consider whether your IT environment supports what you’re trying to achieve.
Ask yourself:
If our business experienced a cyber attack tomorrow, how confident would we be that our customers’ and employees’ information was protected?
If the answer is “I’m not sure”, that’s worth investigating.
This is Where Trusted Advice Matters
At Immervox, we don’t see IT, cyber security and compliance as completely separate conversations.
For many businesses, they are interconnected parts of the same challenge: how do we use technology effectively while protecting our people, our information and our business?
Our role is to help businesses understand that relationship and make sensible decisions about the technology and security controls they rely on.
If you’re reviewing your data protection arrangements following the ICO’s new guidance and would like an independent view of the IT and cyber security side, our experts are here to help.
Useful resource: ICO – Data Protection Essentials
Source: ICO – Boost your business fitness: ICO offers new, free data protection training for SMEs
