How to comply with information security requirements

Published by a LexisNexis Risk & Compliance expert

Practice notes

How to comply with information security requirements

Published by a LexisNexis Risk & Compliance expert

Practice notes

You must have appropriate security in place to prevent personal data being accidentally or deliberately compromised.

Information security is wider than cybersecurity (the protection of your networks and information systems from attack), as information security also covers things like physical and organisational security measures.

This Practice Note reflects requirements in the UK General Data Protection Regulation (UK GDPR) and ICO expectations, as set out in the ICO’s Guide to the UK GDPR, Security.

The CIA triad

The ICO guidance specifically refers to the ‘CIA triad’: confidentiality, integrity and availability.

If any of the three elements is compromised, there can be serious consequences—for you as a data controller and for the individuals whose data you process.

You are also required to ensure the resilience of your processing systems and services. Resilience refers to:

•
whether your systems can continue operating under adverse conditions, eg a physical or technical incident, and
•
your ability to restore them to an effective state

See the range of tools available in subtopic: Business continuity plan.

The

Jurisdiction(s):

United Kingdom

Key definition:

Requirements definition

What does Requirements mean?

A DCO should include “Requirements” to which the development authorised by the DCO is to be subject. Similar to planning conditions, a requirement specifies the matters for which detailed approval needs to be obtained before the development can be lawfully begin.