The General Data Protection Regulation (GDPR) is a regulation in EU law on the processing of personal data. GDPR came into force on May 25, 2018.
Regulates the rights of the person,
whose data are being processed.
Specifies in detail the data security requirements under a risk-based approach.
Formulates the responsibilities of administrators and entities processing personal data (for example, in the scope of incident reporting).
It defines the penalties that can be imposed for violations of the regulation (up to EUR 20 million or 4% of a company’s annual turnover).
How does GDPR affect companies?
- GDPR applies to all companies that collect and use personal data of natural persons (both large corporations and small enterprises).
- With the enforcement of GDPR, a company acting as a data administrator must pay more attention to data security within its organization.
- The company is obliged to implement the necessary technical (e.g., IT tools) and organizational measures (e.g., procedures) to ensure that data are processed in compliance with the regulation, particularly in the area of security, and must be able to demonstrate this.
- Compliance with GDPR security requirements obliges the company to ensure the confidentiality, integrity, and availability of personal data. Therefore, data must be protected against leaks, destruction, accidental loss, or unauthorized access.
- To guarantee confidentiality, integrity, and availability of data, data access control mechanisms (technical or organizational measures) must be implemented.
- The administrator must know who has access to personal data and for how long they are processed.
- Alongside security issues, an important requirement is the need to fulfill various requests of the persons whose data are being processed.
- The administrator must guarantee each person, whose data are at their disposal, the right to access, transfer, correct, or delete data, as well as the right to be forgotten.
- Each company is obliged to implement appropriate technical protection measures and suitable organizational means to immediately detect any personal data breach and promptly inform the supervisory authority and the affected person.
How can Axence nVision® help meet GDPR requirements?
Axence nVision® was developed to assist in managing network infrastructure. The response to GDPR requirements is the DataGuard module and selected functions of the Users module. Other modules also contribute to meeting GDPR-related requirements.
Axence nVision® will help comply with GDPR requirements in the following areas:
Security
- Checking potentially dangerous software and applications.
- Secure data storage.
- Limiting the risk of personal data leaks by controlling access to data media (detecting their connection and blocking them).
- Blocking unauthorized websites and dangerous processes.
- Protecting data against access by unauthorized users.
- The ability to define a policy for transferring corporate data by employees with relevant authorization.
- Alerts in the case of undesirable and potentially dangerous user actions, e.g., connection of USB data media.
- The ability to notify employees about new data security threats.
- The product is designed and developed with the latest IT security knowledge in mind.
Supervision / Audit
- Monitoring all data file operations (auditing file creation, deletion, and copying).
- Monitoring that allows supervision over user logins to workstations.
- Full file access audit enables the administrator to quickly verify and diagnose potential incidents (gathering evidence with identification of the person responsible for the violation).
- The HelpDesk module features help to implement an educational policy within the company and allow users to report dangerous behavior on workstations.
- Printing audit.
- Audit (history) of connections and operations on portable devices and network devices.
Administration
- Axence nVision® does not collect sensitive data.
- Provides management of access rights (writing, executing, reading) for devices, computers, and users.
- Access to personal data and monitoring data can be granted only to designated administrators within the organization.
- It is possible to assign specific rights to selected users.
- The HelpDesk module can be used to report incidents to the IT department (or the relevant designated person, e.g., Data Protection Officer).
Conclusion
Axence nVision® is continuously evolving and being enhanced with new security features, taking into account changes in legislation, including GDPR requirements. The architecture of the solution is designed to meet modern regulatory requirements and ensure an appropriate level of personal data protection.
Through the synergy between system modules, the organization gains a comprehensive set of tools to create a secure and controlled working environment. The combination of DataGuard, Users, HelpDesk, and other modules enables not only the implementation of technical and organizational protection measures but also effective auditing, access control, and incident response.
