Securing Personal Data

“Reasonable security measures” is the most common legal short form expression for regulator’s expectations that organisations protect Personal Data. Unlike other data protection concerns, these expectations apply (more or less) equally to the entire eco-system, be it data owners, data custodian, data intermediaries, and vendors. Often viewed as mostly “IT security”, data protection mechanisms come in fact in hugely diverse forms. While they share certain traits, each have their own advantages, issues, strengths, and risks, depending on the defence concerns and use-case scenarios. The focus of this course is to provide a practically oriented framework and critical comparison of the key principles of protection mechanisms, be they implemented as cybersecurity controls, data protection measures, or privacy engineering techniques. This course is catered to a non-technical audience, covering the crucial points without getting overwhelmed by the challenging technical terms and implementation details. At the end of this course, participants will be in a better position to drive and/or decide about internal/external security approaches and policies, scope and suitability of techniques, and also vendor claims. Participants will better appreciate why “there is no 100% security” and “no one size fits all in security” while getting a sense what can be realistically expected from various existing and evolving techniques and technologies.

For a deeper dive into some of the topics covered in this course, please consider our other courses like Fundamentals of Cryptographic Privacy Enhancing Technologies, Quantum Computing Concepts for Cybersecurity, Anonymisaton, Pseudonymisation, and De-identification Primer, or Cybersecurity Primer.

Who should attend?

• C-Suite, Board members, and DPOs
• Governance, Risk and Compliance Professionals, Data Analysts, Project  Managers
• Executives, Managers, and Staff involved in the management, collection, use or other processing of personal data

Course Details

Course Outline

• Core Protection Mechanisms
  • Access Control
  • Obfuscation
  • Cryptography (Traditional, Quantum, Post Quantum)
  • Removal (Delete / Purge / Secure Erase)
  • Data minimisation

• Personal Data Specific Techniques
  • Pseudonymisation and Anonymisation
  • Privacy Enhancing / Enhanced Technologies (PET)

Course Facilitator

Albert Pichlmaier   Senior Cybersecurity and Privacy Engineer Senior Learning Technology Designer, Drew Data Protection & Cybersecurity Academy