More
GDPR and SSL certificate. Is encryption necessary for compliance with the GDPR?

GDPR and SSL certificate. Is encryption necessary for compliance with the GDPR?

18-05-2018 15:47:40

General Data Protection Regulation (GDPR) is a 99-article regulation meant to protect the private data of Europeans in IT systems. Announced in 2016, covers a broad variety of topics and will go into effect as a requirement on May 25, 2018. GDPR applies to any company doing business in Europe even if it is located elsewhere.

GDPR has clear requirements that can only be addressed through the use of SSL certificates, though it does not contain any specific section on the use of SSL. Article 32 of the regulation ("Security") begins this way:

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

  1. the pseudonymisation and encryption of personal data;
  2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; [...]

In other words, GDPR states that regulated information must be protected with "appropriate technical and organisational measures," including encryption of personal data and the ability to ensure the ongoing confidentiality of systems and services.

If you're putting all your site pages under https and using certificates to authenticate and encrypt communications between internal systems, you're meeting the GDPR requirements for that component of data protection. And if you're not, you should be doing so anyway in order to protect your customers, protect your own business, and save yourself from unprecedented penalties of up to 20 million Euro.

Recent Posts

Comodo / Sectigo is changing its Root CAs
28-12-2018 11:23:52

Sectigo, formerly known as Comodo CA, is entering the next phase of its transition: it’s replacing Comodo CA roots with USERTrust roots on January 14, 2019. Why it happens and what it will mean to Sectigo customers?

Comodo / Sectigo is changing its Root CAs
Comodo is now Sectigo
09-11-2018 12:54:30

According to previous announcements, a year after the acquisition of Comodo Group by Francisco Partners, on November 1 Comodo CA announced that from now on it is changing its brand to Sectigo [pronounced. sec-tee-go]. The goal of rebranding is consistency in company communication and better dedication to what Comodo is doing now.

Comodo is now Sectigo
European Cyber Security Month 2018
27-09-2018 10:46:21

The European Union Agency for Network and Information Security (ENISA), which is the center of knowledge about cyber security in Europe, organizes as every year in October the European Cyber Security Month. The campaign is starting in a few days. What is its purpose and how can you participate in it?

European Cyber Security Month 2018
more posts