GDPR

How can Fluid Attacks help with GDPR compliance?

Ensuring compliance with up-to-date security standards may become a complicated issue for diverse organizations that use continually evolving information technology for their businesses. Fluid Attacks recognizes this and offers you comprehensive testing and analysis to determine whether your company is effectively complying with all corresponding security requirements.

Although Fluid Attacks’ Continuous Hacking service goes beyond the GDPR, testing around 200 technical security requirements in each of your projects, we can guarantee the detection of all vulnerabilities in your software associated with this standard. In addition, we provide you with reliable reports so that your team can take the necessary steps to adjust and maintain your information systems in line with such requirements. We allow you to avoid penalties and, above all, guarantee secure systems for customers or users, thus ensuring their continued trust.

All our security testing is based on Criteria, which is a set of security requirements written by us in a comprehensible manner, using several international standards as a reference. It allows you to parameterize the assessments we make to your systems and determine what your company agrees to comply with and what would be considered a vulnerability.

What is GDPR?

GDPR refers to the General Data Protection Regulation that appeared in 2016 and was implemented in 2018 as a replacement of the EU Data Protection Directive 95/46/EC. GDPR is constituted as a set of rules for data protection and privacy within the European Union (EU) and the European Economic Area (EEA). The GDPR rules apply to any company that stores, processes or transfers personal information of European citizens, even operating outside those territories. GDPR aims to protect data that can lead to the identification of a person. Beyond the typical examples of names, numbers and addresses, it also covers, for instance, health treatments and history, economic situation, physical and behavioral characteristics, and even genetic data. Organizations are required to follow data protection requirements in processing activities and business practices from their initial stages.

What is GDPR compliance?

GDPR is a regulation that unifies international data protection laws within Europe, and at the same time reinforces the individual rights in relation to the handling of their personal data. GDPR compliance is an obligation for companies of all sizes both inside and outside Europe that make use (not only through digital means) of personal information of European subjects.

To ensure GDPR compliance, and after understanding the corresponding legal framework, it is necessary that every company follow multiple requirements that are associated with a diversity of practices, such as the following:

Identify all personal information being used.
Recognize the infrastructure and all parties involved in the use of information.
Evaluate private data access permissions.
Verify that explicit consents are requested for the use of the information.
Maintain data processing with documented legal support.

Compliance with this regulation may concern all members of an organization. It is expected that breaches or theft and misuse of customer and user information be avoided at all costs. Penalties for non-compliance with GDPR can currently correspond to fines of up to €20 million or 4% of the global annual turnover, whichever is higher.