Book description
Applying the Data Protection Act to the Cloud
The UK’s Data Protection Act 1998 (DPA) applies to the whole lifecycle of information, from its original collection to its final destruction. Failure to comply with the DPA’s eight principles could lead to claims for compensation from affected individuals and financial penalties of up to £500,000 from the Information Commissioner’s Office, not to mention negative publicity and reputational damage.
An expert introduction
More than 85% of businesses now take advantage of Cloud computing, but Cloud computing does not sit easily with the DPA. Data Protection and the Cloud addresses that issue, providing an expert introduction to the legal and practical data protection risks involved in using Cloud services.
Data Protection and the Cloud highlights the risks an organization’s use of the Cloud might generate, and offers the kind of remedial measures that might be taken to mitigate those risks.
Topics covered include:
Protecting the confidentiality, integrity, and accessibility of personal data
Data protection responsibilities
The data controller/data processor relationship
How to choose Cloud providers
Cloud security – including two-factor authentication, data classification, and segmentation
The increased vulnerability of data in transit
The problem of BYOD (bring your own device)
Data transfer abroad, US Safe Harbor, and EU legislation
Relevant legislation, frameworks, and guidance, including:
the EU General Data Protection Regulation
Cloud computing standards
the international information security standard, ISO 27001
the UK Government’s Cyber Essentials scheme and security framework
CESG’s Cloud security management principles
guidance from the Information Commissioner’s Office and the Open Web Application Security Project (OWASP)
Mitigate the security risks
Mitigating security risks requires a range of combined measures to be used to provide end-to-end security. Moving to the Cloud does not solve security problems, it just adds another element that must be addressed. Data Protection and the Cloud provides information on how to do so while meeting the DPA’s eight principles.
About the author
With a background in IT focussed on CRM and other information management applications, Paul Ticher has worked on data protection for over 20 years. He is now a well-known consultant on the topic, mainly to non-profit organizations , and specialises in work with charities and voluntary organizations . Paul is the author of the standard work Data Protection for Voluntary Organisations (now in its third edition) as well as materials for ITGP and other publishers. He also carries out data protection reviews and delivers training and webinars on the topic.
Learn how to move to the Cloud and still meet the DPA’s principles – buy this book today!
Table of contents
- Cover
- Title
- Copyright
- Contents
- Introduction
- Chapter 1: Background – The Data Protection Principles
- Chapter 2: The Data Controller/Data Processor Relationship
- Chapter 3: Security (Seventh Data Protection Principle)
- Chapter 4: Mitigating Security Risks in the Cloud
- Chapter 5: Transfers Abroad (Eighth Data Protection Principle)
-
Chapter 6: Other Data Protection Principles
- First Data Protection Principle (Fairness, Transparency and Choice)
- Second Data Protection Principle (Specified and limited purposes)
- Third Data Protection Principle (Adequate, Relevant and not Excessive)
- Fourth Data Protection Principle (Accuracy)
- Fifth Data Protection Principle (Limited retention)
- Sixth Data Protection Principle (Data Subject rights)
- Chapter 7: Other legal and technical implications for cloud contracts
- Chapter 8: Enforcement
- Chapter 9: The proposed new EU Regulation and other measures
- Chapter 10: Checklist
- References
- ITG Resources
Product information
- Title: Data Protection and the Cloud: Are the risks too great?
- Author(s):
- Release date: February 2015
- Publisher(s): IT Governance Publishing
- ISBN: 9781849287135
You might also like
book
Asset Protection through Security Awareness
Supplying a high-level overview of how to protect your company's physical and intangible assets, Asset Protection …
book
People-Centric Security: Transforming Your Enterprise Security Culture
A culture hacking how to complete with strategies, techniques, and resources for securing the most volatile …
book
Lean Auditing: Driving Added Value and Efficiency in Internal Audit
"How can you argue with the core principles of Lean, that you focus on what provides …
book
Advanced Persistent Training : Take Your Security Awareness Program to the Next Level
Gain greater compliance with corporate training by addressing the heart of the very awareness vs. compliance …