GDPR's Information Security Requirements - What Exactly is 'Appropriate'?

Explore the complexities of GDPR's information security requirements in this 40-minute conference talk from RSA Conference. Delve into the concept of 'appropriate' technical and organizational measures for ensuring personal data protection. Learn how to interpret Article 32's guidance on factors like cost, risk, state of the art, scope, and purpose to determine what's suitable for your organization. Gain insights into regulatory perspectives and develop a framework for assessing and implementing appropriate security measures. Understand the impact of variables such as implementation costs, risk levels, and fundamental rights on security decisions. Discover how to create a good security baseline, calculate risks, and adapt to changing appropriateness standards. Equip yourself with the knowledge to navigate GDPR compliance effectively and confidently justify your organization's security approach to regulators.

Intro
What is appropriate
Law
Formula
Cost of implementation
Risk
Fundamental Rights
Impact Scales
Risk Calculation
Good Security Baseline
Security Outcomes
Who determines whats appropriate
What is inappropriate
Inconsistencies
Big or Small
Summary
Appropriateness Changes
Questions