GDPR’s Information Security Requirements – What Exactly is ‘Appropriate’?
summary
Defines how organisations can interpret GDPR Article 32’s requirement for ‘appropriate’ technical and organisational measures to protect confidentiality, integrity, availability and resilience of personal data. Covers using factors named in Article 32—cost, risk, state of the art, scope and purpose—to assess and justify security choices and how regulators might evaluate whether those measures are adequate.
AI-written summary · about
chapters (18)
- 0:00Intro
- 2:42What is appropriate
- 4:10Law
- 10:10Formula
- 13:55Cost of implementation
- 17:00Risk
- 18:40Fundamental Rights
- 21:15Impact Scales
- 22:40Risk Calculation
- 25:55Good Security Baseline
- 28:00Security Outcomes
- 29:00Who determines whats appropriate
- 29:30What is inappropriate
- 33:20Inconsistencies
- 33:55Big or Small
- 34:55Summary
- 35:45Appropriateness Changes
- 36:20Questions
related talks
01h 10mThe state of the art requirement for GDPR security measures.
01h 13mThe risk-based approach to privacy: How far should we go?
30mPrivacy by Design?
16mThe Importance of Data Protection Compliance and Cyber Security
01h 16mSecurity meets data protection: risk assessment, standards and certification
01h 00mPrivacy and GDPR: What all developers should know
23mdev.privacy: GDPR in a nutshell
49mPractical privacy: GDPR explained