Difference between data protection and data security

What is the difference between data protection and data security?

The terms "data protection" and "Data security" are often used synonymously. However, they are not congruent and address different approaches. Data security is the use of tools and techniques that protect data or information, such as network security, mobile data security, database security and identity management, Encryption etc. Data security protects this data from hackers or other unauthorized access.

At the Data protection The issue is for what purposes and on what legal basis personal data are collected and processed. For a better understanding of the objectives of data protection, you should take a closer look at the six principles of the General Data Protection Regulation:

• Legality, Processing in good faith and Transparency
• Earmarking
• Data minimization
• Correctness
• Storage limitation
• Integrity and Confidentiality

These six principles must be observed when complying with the GDPR or other, to the GDPR data protection regulations.

Why are data security and data protection important?

When we say that it is Data security without data protection, we usually mean that in the case of the Data security the data is well protected from breaches or leaks with security tools and techniques such as anti-malware software, anomaly detection or firewalls, but the data protection principles may not have been applied as well and therefore may not comply with the

data protection laws to protect the informational self-determination of consumers. This could mean that a company retains data without a legal basis, that it has collected too much or that it stores it for too long. It is quite possible that you are protecting data that you should not be storing at all.

Data protection management software such as 2B Advice PrIME can help companies to understand how the six Principles of the GDPR and support them in developing a compliant data protection program. Good Data security and data protection management go hand in hand to ensure that you store the right data securely.

How can data security and data protection reduce the risk of data breaches?

Data security and data protection not only make good business sense, but also reduce the risk and frequency of data breaches and data loss. Depending on which data protection regulations you fall under, the fines and penalties for compliance violations or data breaches can be very costly for a company. In the case of particularly serious breaches, which are defined in Art. 83, para. 5 GDPR the range of fines can be up to 20 million euros or, in the case of a company, up to four percent of its total global turnover in the previous year, whichever is higher. But even for less serious violations, the GDPR fines of up to EUR 10 million or, in the case of a company, up to two percent of its total global turnover in the previous year, whichever is higher.

In the US state of California, the CPRA Privacy Rights Act not only deals with data protection, but also obliges the companies concerned to take appropriate security precautions to protect personal data, whereby Data security and data protection must be linked, as companies must also protect the data they hold.

Under California's CPRA, administrative penalties of up to $2,500 per Infringement (or three times that amount, $7,500, for willful violations or violations involving minors under the age of 16). In addition, California provides a right of action for consumers "whose unencrypted and unprotected personal data ... are subject to unauthorized access and disclosure, theft, or disclosure as a result of the company's failure to establish and maintain reasonable security procedures and practices..." and who may bring a civil action as a result. Companies that are victims of data theft or other breach of the Data security may be ordered to pay statutory damages of between $100 and $750 per California resident per incident or actual damages, whichever is greater, in civil class action lawsuits, as well as any other compensation a court deems appropriate, with the California Attorney General's Office having the option of prosecuting the company criminally rather than allowing civil actions to be brought against the company.

How can data protection and data security be guaranteed?

To ensure the security of data, companies generally use IT tools and techniques to protect networks, databases and mobile devices, e.g. VPNs, firewalls, anti-virus and anti-malware software as well as measures such as vulnerability scans and penetration tests, Pseudonymization, Encryption etc. This is intended to protect sensitive data from hackers or other unauthorized access.

To ensure adequate data protection, companies must identify what types of data they have and where they are stored. This should be done with a Data protection impact assessment begin, especially if the GDPR is applicable to them and the data may be sensitive or high-risk. Article 35 GDPR explains:

Has a form of Processingin particular when using new technologies, due to the nature, scope, circumstances and purposes of the Processing is likely to result in a high risk to the rights and freedoms of natural persons, the Responsible persons assess in advance the impact of the intended processing operations on the protection of personal data.

As soon as a company has Data protection impact assessment Once the data protection management process has been completed, it makes sense to have a place where the processing activities identified and the processors involved can be documented, as well as a reporting function to demonstrate compliance with accountability. It is very useful to use a scalable data protection management software solution to conserve scarce resources.

Why is data security so important?

Data security is an important aspect of running a business of any size, whether it's a startup or a global corporation with thousands of employees. By ensuring adequate security of personal data that your company collects, receives, stores and transmits, you can minimize the number of data breaches your company could suffer. A data breach can cost a company thousands of euros in fines, and not only that, data breaches can cause significant damage, including loss of revenue and damage to brand value by affecting consumer perception and trust in a company.

What is the role of data security?

The task of the Data security is to protect the data that your company collects, receives, stores and forwards. Companies can use a range of IT tools and techniques to Data security use. It also plays an important role in maintaining security and data protection compliance.

Why is it important to know the difference between data security and data protection?

It is important to understand the difference between Data security and data protection, because the difference lies in what data is protected, how this data is processed and who is responsible for protecting the data. With the Data security is about protecting data from data loss, unauthorized access via security breaches, leaks, etc., while data protection is about the responsible use of data with Consent of the data subject, be it an employee or a customer. Knowing the difference is the first step to adequately protecting your data.

What is personal data?

Personal data obviously includes important identifiers such as social security number, passport number, driver's license and date of birth, which if known or lost, could be used for identity theft. However, there are many other types of data that could be used as personal data internal knowledge or preference factors, financial data, medical or health data, etc. Health datahistorical, social or external factors such as unique identifiers, ethnicity, sexual, demographic or physical characteristics. The GDPR even includes web identifiers such as IP addresscell phone number or geolocations.

Who is responsible for data security?

In most companies, the responsibility for the Data security in the IT department, which is headed by the Chief Information Officer (CIO) or IT Director. In more and more companies, there is also an independent department for Data securitywhich is headed by a Chief Security Officer (CISO) or Information Security Officer.