What can professional services businesses do now to prepare for GDPR?
(Click Speaker icon to turn mute off)
The General Data Protection regulation was adopted on 27 April 2016 and applies from 25 May 2018. There are some things that you can start doing right now, and we go into more detail in the article below.
1. Start work to achieve Cyber Essentials certification
2. Take a daily encrypted backup of your business data
3. Ensure that your IT System is secure by design
4. Ensure that all employees are sharing your business files securely using appropriate business file sharing software and particularly not the free versions of Box and Dropbox
5. Educate your staff about the need for strong and unique passwords
Cyber Essentials
This is a self-signed security MOT, meaning that at a given time your IT was secured to a known benchmark standard. Usually there is some work involved in getting things to that standard, and then some more work in keeping people to that standard. nTrust Systems helps businesses achieve Cyber Essentials certification – Read about Cyber Essentials
Data encryption and backup
We hear from customers that insurance companies and lawyers are advising professional services companies such as financial advisers, accountants and solicitors to encrypt their customer data. This is good advice, certainly for backed up data.
We strongly recommend that all backed up data is encrypted. nTrust Systems hosted back-up is encrypted in transit and at rest.
Read more about nTrust Hosted Back-up here
Encrypting the data that you are working with is a different matter. The trouble with encrypting client data is that you can only read it by unencrypting it and this may be counter-productive.
Businesses need to:
Be able to work with client data
Have an IT system which is ‘Secure by Design’ (encrypted does not necessarily equal secure)
Be aware of their obligations, and their rights
Store no more personal data than needed
If you are a firm of accountants, you cannot encrypt client data any more than Iris or Sage will let you as so much of your clients’ data is held in either one or the other.
IT systems that are secure by design – hosted desktop (aka remote desktop, virtual desktop)
Hosted Desktop from nTrust Systems is secure by design because
All data is stored off-site in a highly secure Surrey datacentre
All data is stored on this central server, not on workers’ devices
The session to the server is secured by encryption
Data downloads from the server can be restricted if you wish
Workers can use their own devices, whilst business owners have the peace of mind that all company data is on the server/backed up
Software patches and updates promptly applied to the one central server, hence available simultaneously to all workers, no matter which device they use to log in. This improves security for the entire business
Hosted desktop by nTrust Systems improves data safety because
You have a fully managed off-site IT service
Your business data is backed up daily, with encryption in transit and at rest
You have business continuity if disaster strikes
Your business data is no longer stored on individual’s devices, so if a device fails, is lost or stolen, data confidentiality is not compromised.
Read more about nTrust Hosted Desktop
Sharing your business files
Businesses will be increasingly be required to provide an audit trail for all personal data files that are shared with others.
Businesses should be asking where this shared information is stored and who owns it.
nTrust FileCloud is file syncing and sharing software that gives you these answers. Data is stored in a highly secure Surrey datacentre and only you own your data. FileCloud has powerful built-in ransomware protection. Your data is fully encrypted in storage.
Read more about nTrust FileCloud
Passwords
Ensure that every individual in your businesses knows the following:
Change any password that may have been compromised
Never use system default passwords – for example, it would be foolish to sign on as Manager without a password in Sage accounts software, or Master and Money in Iris.
Never use the same password for all accounts
Never store passwords in an Excel or Word document. We recommend a (free) encrypted password safe program that stores all customer passwords, with different safes for different jobs
