5 Steps to Implement Backups on Your Systems and Comply with GDPR
With the entry into force of the new General Data Protection Regulation, a large number of companies have found it necessary to adapt their technological platforms. This regulation poses a series of requirements, which are aimed at preserving user data and providing them with appropriate treatment.
Backup is the central procedure and figure during data protection, being a very important backup in case of total or partial loss of data. For this reason, making a backup copy of your system is one of the best options to start complying with the GDPR in your commercial organization.
< Ready for GDPR?>>
5 steps to ensure GDPR compliance
To carry out this procedure and be up to date with the new European data protection law, you can follow these 5 important steps:
1. Audit your system and map the data flow
Auditing systems is a frequent activity in the field of IT security. In this procedure, we will try to locate possible vulnerabilities within the data flow and also determine
When is the ideal time or frequency to perform the backup?This process can be carried out from a central server, however, when companies have decentralized branches, the audit, planning and execution is carried out individually.
2. Assign responsibilities within the company
The association between
GDPR and backup is complex, therefore, strict responsibilities must be created within the company. An important step required by the data protection law is the s
Election and appointment of a data protection officer. Which will be in charge of planning the
backup procedure and other IT security plans related to data protection. Likewise, the data protection officer will be responsible for hiring third parties when it is desired to outsource the data backup procedure, and will also be in charge of carrying out tests with real data.
3. Evaluate current data protection measures and their response capacity
Within the company's data protection plan, all processes and
evaluate the effectiveness as well as the responsiveness in the event of any unexpected event. The time stipulated for detecting and reporting any unexpected event must not exceed 72 hours, otherwise, various sanctions may be imposed by administrative bodies.
4. Allows data deletion
One of the most interesting topics of the new GDPR and backup is the obligation to be able to allow the right to be forgotten. This is a complex procedure, especially if you have multiple decentralized branches, since you must be able to completely delete any information concerning an individual, if they were to request it. In addition, you must also delete the data from the backup copies. Therefore, you must keep all the backups operational.
options that allow you to consult, modify and delete data.
5. Create cloud backups
El
data backup has traditionally been done on magnetic tapes. However, the GDPR requires using methods in which individuals' information is more secure. Using
Cloud storage is a recommended alternative, since there are servers like the
Amazon Web Services cloud that have
rigorous security protocols. This is a medium that you can access from anywhere and at any time, it is perfect for multi-site SMEs. These are just some recommendations at a technological level, however, it has become practically essential to have the help of an expert in legal matters and data processing to ensure that your company is treating the data contained in your database correctly. Do not hesitate to contact them to certify that you are doing things correctly.
If you found this post interesting, you might also be interested in this free PDF ebook:
https://mkt.apser.es/ebook-preparado-para-el-rgpd
