GDPR

Be Inspired | GDPR | How to Make Sure Your Staff Don’t Breach Your Data Security

How to Make Sure Your Staff Don’t Breach Your Data Security

It may be the cyber attacks which make the headlines, but the most common breaches are the ones that occur internally in your organisation. In fact, around 90% of data breaches are caused by human error. Staff are often responsible for data breaches, from losing a memory stick to sending the wrong file or even emailing the wrong person.

With GDPR coming to effect very soon, many companies are focusing on the technical aspects of data encryption and systems analysis to ensure compliance. However, staff training and awareness is also essential to maintain data protection compliance and reduce the risk of a breach which could cause a hefty fine under the GDPR.

So, how can your organisation manage the biggest risk of data breaches?

Five top tips to ensure staff do not breach your data security

1. Have a GDPR staff meeting

It is vital that every member of staff understand what GDPR is and how they are directly affected as a result. Explaining the risks of a €20 million or 4% of your global annual turnover fine can help staff to understand how critical data compliance is. In this meeting, you can also explain your own policies and procedures regarding data compliance. If staff understand that data breaches can lead to dismissal and disciplinary action, it can help to highlight the importance of being data aware.

2. Create a personal information training checklist

A simple checklist that can be signed by the trainer and staff member can help to make sure that staff understand data from a personal point of view. It is also an easy addition to induction training to make sure every member of the team understands your data policy. The checklist can include aspects such as;

  • Knowledge of secure passwords
  • How to lock/logoff computers when away from their desk
  • Secure shredding policy
  • Visitor area restrictions and clearance policy
  • Personal information encryption
  • Back-up and storage of data
  • Clear desk policy
  • Not opening links, downloading unknown files or opening foreign USB sticks

3. Make training relatable

Instead of an off the shelf training course, a relevant training course that covers the activities of your business will be much more interesting and engage your employees. GDPR and data protection can affect organisations in different ways. By understanding your specific risks and activities, you can make sure the training applies to the situations that your staff face.

As well as making the training bespoke to your business, it is well worth opening discussion after training to make sure employees have the chance to ask questions for any aspects they do not understand and raise ideas that can help your business from their perspective. After all, there may have been a vital process that could have been missed.

4. Create an information request policy

Frontline staff may come into contact with customers requesting knowledge of the personal information that you hold about them. As part of GDPR, individuals have the right to know what personal information that your business owns. Your staff will need to be aware how to handle an access request and ensure that no data breaches take place by fraud.

Staff will need to know that there is a maximum £10 fee for requesting information and that your team needs to respond within 40 days to any customer information request. This means that communication must be checked regularly and processed with appropriate urgency.

An essential aspect of the information request policy is when other people’s information is contained within the response given to a customer. This is a common area where a data breach can occur.

5. Keep staff aware

Data compliance is not a one-off training event; your organisation will always need to keep data compliance at the forefront of their work actions. Using incentive, games and rewards, you can help to keep GDPR and data protection relevant and prominent in the workplace.

From e-learning, customised training and checklists, you have a wealth of tools to help highlight the importance of data compliance at regular intervals. Make sure training and catch up sessions are routine and if you make any modifications to your data policy, keep the team informed and use techniques to ensure your new processes are fully understood.

It may be worth conducting mystery shopping and random testing to make sure all your staff are fully compliant, while incentives can ensure they remain enthusiastic and keen to comply.

Discover more top tips from Cyan Solutions

If you need any help in securing your company and reducing the threat of data breaches, then Cyan Solutions can help. At Cyan Solutions, our IT experts can help to assess all the internal threats that your business faces. Furthermore, we can use our experience and expertise to give you our top tips to ensure your staff are ready and prepared for data compliance changes and GDPR.

 

Categories: GDPR, IT Security, News

Categories