hi my name is annie and today i'm here with amy brown and rachel salter who are both consultants with us at urm welcome to another episode of infosec insider talk dp so today we're going to be talking about lawful basis in gdpr compliance and why getting it wrong undermines everything so my first question for you guys is why is lawful basis the foundation of gdpr compliance

that's a good question um i think before we really dive into that i think what we need to establish is what is lawful basis because i talk to clients regularly and they're not actually sure what i'm saying to them what we actually mean by lawful basis is the legal reason to do something So when we're processing data, we need to have a legal reason to do it.

And if there's no legal reason for us to be processing that data, then we shouldn't be doing it.

So it's important because fundamentally it makes up the framework of privacy.

So it's one of the six lawful basis, six legal reasons to process something.

And we should be able to in every walk of life, every part of business when we're processing data, we should be able to tie that back to one of those legal reasons to process the data.

So I think that's really important because I get that quite a bit.

What changes when special category personal data is involved?

So you've got those different aspects within the different incidences as well, which I don't think people really understand very well.

And that's what I'm saying.

I think it's really important to define quite quickly, is it a data breach? You know, the legislation basically says that a data breach is where someone accesses information they're not entitled to have.

It's really that simple.

And that could be like Amos's, you know, that you could have poor quality data on your systems, which will be a breach of principle for the accuracy principle.

People think that a breach is the loss of something potentially rather than just the mismanagement of it.

And it can be so much more.

I mean, even with the experience that we've both got, you have to question yourself, don't you? You have to really stop and think and really delve deep into it as to understand what the risk can be.

So the risk to the PECA compliance is, not being in place has just grown exponentially for any business.

I think it's made a few sit up and listen, hasn't it, Amy? Certainly some of our clients are now thinking, you know, 500,000 sat in the budget for a potential fine.

Is it the end of the world? Maybe not.

But, you know, 4% of your global turnover, so many million, you're not sitting with that in your budget every year in your accounts in the anticipation that you might get a fine.

So it's certainly it's now more on the radar for a lot of people.

I think it's important to understand, though, there are different types of cookies and some are more important than others.

And that's the problem.

think it's talked about enough is it

companies want to know that people are being productive and the technologies are then suddenly all of a sudden there to help them do that without putting the right date protection things in place to make sure you're doing it properly you're being proportionate it's being transparent and it's it's got all of the right boxes ticked

it's just not enough though is it i mean it's like i can remember um you know just just that's a code bit speaking to a client who had some software on his laptop to make his mouse move constantly so that he could actually look like he, to the outside world, if his keyboard or his system was being monitored, he was moving his mouse around.

He was working.

He was live and online.

And I was like, that's crazy.

You know, like why, you know, well, you know, but it looks like I'm online and, you know, if they're monitoring me and I'm like, you know, but then could be monitoring way more than that.

You're not actually doing anything with that.

much about it, but I know you've got something coming up about it.

And we've seen a high profile case quite recently in the news where that's actually been done.

Yeah.

But that's been happening for years, hasn't it? I mean, you know, even pre these electronic solutions, these tools, you know, back in my day, 20 years ago, you printed out a document and used a black marker.

You put a marker through something and you thought, that's fine now.

I've put the marker through the name Rachel.

I can send this out.

But you hold that piece of white paper up to the light and through that black marker, you can see what the word used to be, you know, what used to be there.

Why is consent still one of the most misunderstood parts of data protection?