Cyber security and data protection go hand in hand. If your business holds personal data about customers, employees or suppliers, you have a responsibility to keep that information secure. Under the UK GDPR, organisations must use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or damage.
One useful starting point for businesses is Cyber Essentials, the UK Government-backed scheme designed to help organisations protect themselves against common cyber attacks.
What is Cyber Essentials?
Cyber Essentials provides a set of basic technical controls covering areas such as:
- Firewalls
- Secure configuration
- Security updates
- User access controls
- Malware protection
It is a practical way for businesses to assess whether they have some of the basic protections in place. The ICO also identifies Cyber Essentials as a useful starting point for organisations looking to put appropriate technical controls in place to protect personal data. However, it is only a baseline. Depending on the information you hold and the risks involved, you may need additional measures.
What’s changed?
The latest version, Cyber Essentials v3.3, introduced changes including clearer requirements around cloud services, passwordless authentication, software development, scope and backups.
Cloud services are now clearer
Many businesses store personal data in cloud-based systems such as email, document storage, accounting platforms and CRM systems. The updated requirements make it clear that cloud services cannot simply be excluded from the scope of Cyber Essentials. For data protection, this is important. If personal data is stored or processed in the cloud, you still need to understand how it is protected and who can access it.
Backups matter
The updated requirements also place greater emphasis on backing up data. From a data protection perspective, backups aren’t just about recovering from a cyber attack. The ability to restore access to personal data following an incident is part of the security principle under the UK GDPR.
Ask yourself: if our systems were attacked tomorrow, could we recover our important personal data?
Access needs to be controlled
Cyber Essentials includes user access controls, while the ICO expects organisations to understand who has access to personal data and limit access to people who genuinely need it.
That means regularly checking your user accounts is important. When someone joins your business, do they get the right access? When their role changes, is their access updated? When they leave, is their access removed?
Cyber Essentials isn’t the whole GDPR picture
Getting Cyber Essentials certification does not automatically make your business GDPR compliant.
The UK GDPR takes a risk-based approach. The security measures you need depend on your organisation, the personal data you process and the risks involved. The ICO specifically points out that businesses may need to go beyond Cyber Essentials depending on their circumstances.
You may also need to consider measures such as encryption, appropriate policies and procedures, staff training, access controls, incident management and regular testing of your security measures.
The takeaway for small businesses
Think of Cyber Essentials as a good security foundation, rather than a complete data protection solution.
If your business holds personal data, think about:
What data do we have?
Where is it stored?
Who can access it?
How is it protected?
Could we recover it if something went wrong?
Are our security measures appropriate for the risks?
Cyber security isn’t separate from GDPR. Protecting personal data means protecting the systems, devices, accounts and services that handle it.
A strong approach to data protection therefore starts with good security.