4

... And to what extent? E.g. what is the minimum an online service or software vendor are required to do to protect personal data? Let's not talk about PCI-DSS and payments here.

2

What is the minimum an online service or software vendor are required to do to protect personal data?

In the UK that is covered by the Data Protection Act 1998. The full Act can be downloaded here (pdf)

The Data Protection Act controls how your personal information is used by organisations, businesses or the government.

Everyone responsible for using data has to follow strict rules called ‘data protection principles’. They must make sure the information is:

  • used fairly and lawfully
  • used for limited, specifically stated purposes
  • used in a way that is adequate, relevant and not excessive accurate
  • kept for no longer than is absolutely necessary
  • handled according to people’s data protection rights
  • kept safe and secure
  • not transferred outside the European Economic Area without adequate protection

There is stronger legal protection for more sensitive information, such as:

  • ethnic background
  • political opinions
  • religious beliefs
  • health
  • sexual health
  • criminal records

Source Data protection


Guide to data protection - Information security (Principle 7)

This part of the guide offers an overview of what the Data Protection Act requires in terms of security, and aims to help you decide how to manage the security of the personal data you hold. We cannot provide a complete guide to all aspects of security in all circumstances and for all organisations, but this part identifies the main points. We also provide details of other sources of advice and information about security.

There is no “one size fits all” solution to information security. The security measures that are appropriate for an organisation will depend on its circumstances, so you should adopt a risk-based approach to deciding what level of security you need. In brief – what does the Data Protection Act say about information security?

The Data Protection Act says that:

"Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."

This is the seventh data protection principle. In practice, it means you must have appropriate security to prevent the personal data you hold being accidentally or deliberately compromised. In particular, you will need to:

  • design and organise your security to fit the nature of the personal data you hold and the harm that may result from a security breach;
  • be clear about who in your organisation is responsible for ensuring information security;
  • make sure you have the right physical and technical security, backed up by robust policies and procedures and reliable, well-trained staff; and
  • be ready to respond to any breach of security swiftly and effectively.

...

What level of security is required?

The Act says you should have security that is appropriate to:

"the nature of the information in question; and the harm that might result from its improper use, or from its accidental loss or destruction."

The Act does not define “appropriate”. But it does say that an assessment of the appropriate security measures in a particular case should consider technological developments and the costs involved. The Act does not require you to have state-of-the-art security technology to protect the personal data you hold, but you should regularly review your security arrangements as technology advances. As we have said, there is no “one size fits all” solution to information security, and the level of security you choose should depend on the risks to your organisation.

...

What level of security is required?

The Act says you should have security that is appropriate to:

"the nature of the information in question; and the harm that might result from its improper use, or from its accidental loss or destruction."

The Act does not define “appropriate”. But it does say that an assessment of the appropriate security measures in a particular case should consider technological developments and the costs involved. The Act does not require you to have state-of-the-art security technology to protect the personal data you hold, but you should regularly review your security arrangements as technology advances. As we have said, there is no “one size fits all” solution to information security, and the level of security you choose should depend on the risks to your organisation.

The following link goes into a lot more detail on this topic.

Source https://ico.org.uk/for-organisations/guide-to-data-protection/principle-7-security/

Further Reading

| improve this answer | |
  • Thank you. Is there a definition of what is understood as 'kept safe and secure'? – G33K Oct 28 '15 at 21:10
  • That's kind of covered in the second part of my answer ... I haven't been able to find a formal definition yet. – DavidPostill Oct 28 '15 at 21:11
  • I mean for personal data not falling into any of those categories in the second part of your answer. – G33K Oct 28 '15 at 21:14
  • I've added another section "What level of security is required?". Unfortunately the Act (as is pointed out in the commentry from cio.org.uk" keeps saying "The Act does not define “appropriate”. – DavidPostill Oct 28 '15 at 21:21
  • I think you have to be a Government Minister or a Lawyer to completely understand all of this. The further reading link tries to exaplain the Data Protection Act in an understandable way ... – DavidPostill Oct 28 '15 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.