Trustwave's 2024 Retail Report Series Highlights Alarming E-Commerce Threats and Growing Fraud Against Retailers. Learn More
Get access to immediate incident response assistance.
Get access to immediate incident response assistance.
Trustwave's 2024 Retail Report Series Highlights Alarming E-Commerce Threats and Growing Fraud Against Retailers. Learn More
According to the General Data Protection Regulation (GDPR), an entity must have a "valid lawful basis" to process personal data. If you can process data without handling any personal information of the user, then continue that way. If not, the law defines six lawful reasons for processing personal data:
No one basis is more important than the other or should be viewed as the path of least resistance. The basis you should operate under will come down to your purpose for processing personal data and the ongoing relationship you plan to have with the data subject.
However, one of the six is more complex to implement than the others, but it is also likely to engender the most trust: consent. Gaining consent should put the power in the hands of an individual so that they have a real and genuine choice about how their personal data is used and processed. That is backed by the GDPR requiring "positive opt-ins," so no methods of default consent are allowed.
This approach presents advantages. Giving the individual control to make their own choice engenders trust and can enhance an organization's reputation because there is nothing hide, so to speak. In a world with long privacy notices and abundant product notifications, your clients may find an open and honest approach to consent to be refreshing.
A checklist to help you take the right approach when it comes to consent should include the following actions.
Try to ensure:
As you can see, there is a lot to consider, including what to do if you offer online services to children or how will you record consent, so careful planning is a must. Individuals also have certain rights under the GDPR which you should consider when following the consent path as a lawful basis, including the right to restrict processing, erasure and the right to be informed.
Obviously before you can do any of this, you need to know where your data flows and what is subject to the GDPR. Trustwave can help with a range of offerings, including workshops, risk assessments, privacy assessments and more.
Brian Odian is managing consultant of global compliance and risk services.
Trustwave is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.
Copyright © 2024 Trustwave Holdings, Inc. All rights reserved.