NCSC and ICO publish cyber security guidance on GDPR

What does the GDPR mean for cyber security?

The GDPR requires that personal data must be processed securely using appropriate technical and organisational measures. The Regulation does not mandate a specific set of cyber security measures but rather expects you to take ‘appropriate’ action. In other words you need to manage risk. What is appropriate for you will depend upon your circumstances as well as the data you are processing and therefore the risks posed, however there is an expectation you have minimal, established security measures in place. The security measures must be designed into your systems at the outset (referred to as Privacy by Design) and maintained effective throughout the life of your system.

The NCSC have worked with the ICO to develop a set of GDPR Security Outcomes. This guidance provides an overview of what the GDPR says about security and describes a set of security related outcomes that all organisations processing personal data should seek to achieve. The approach is based on four top level aims:

  • manage security risk
  • protect personal data against cyber attack
  • detect security events, and
  • minimise the impact

A good starting point for advice on implementing security measures for the GDPR is existing good cyber security guidance. Some good sources of information include our 10 Steps to Cyber SecuritySmall Business Guide or the Cyber Essentials scheme. You can also share information, advice and intelligence about cyber risks online by joining our CISP community.

Reporting incidents involving personal data

If you are affected by an incident which involves (or is likely to involve) a breach of personal data, then you are likely to have an obligation under the GDPR to notify the ICO. The ICO provide more detailed guidance on their website about what constitutes a notifiable breach, preparing and responding to breaches.

You may also wish to report significant cyber incidents to the NCSC. If the incident is likely to have a national impact then we will seek to provide support, subject to resource constraints. National impact includes harm to national security, the economy, public confidence, or public health and safety. We would also welcome notification of incidents ‘for information’ which you feel may be of interest, for example incidents which may contribute to our understanding of adversary activity, inform the guidance we provide, or help other organisations.

Incidents below national threshold should be reported to Action Fraud – the UK’s national fraud and cyber crime reporting centre or, if you're in Scotland, then reports should be made to Police Scotland

The Information Commissioner’s Office (ICO) is the UK's supervisory authority for the GDPR and is responsible for promoting and enforcing the legislation, as well as providing advice and guidance to organisations and individuals. The ICO has published a lot of helpful guidance on its website. This should be your first port of call for any overarching GDPR queries you might have.

The GDPR Security Outcomes can be read here in full

Share this


Join us for an Introduction to techUK on Tuesday 24 November. Whether you are new to techUK, thinking of joining u…
Last chance to join us for Hong Kong Fintech Week 2020! If you're a techUK member, claim your discounted access to…
🚨 New #techUK report - Delivering diversity. techUK has catalogued how members are being proactive in tackling ine…
Data adequacy is a hot trend right now. Read our experts letter for @LawSocBrussels delving into importance of data…
@AwenCollective Welcome to techUK - we are delighted to have you on board!
The @techcharterUK have launched a new campaign called #DoingItAnyway to help more women get into #tech. Get inspi…
Join our friends @bethebusiness and @Facebook next Wednesday for their latest regional event. If you’re a business…
FINAL CALL: Nominations to the Health and Social Care Council close on the 2nd November. Step up and help to lead t…
Become a Member

Become a techUK Member

By becoming a techUK member we will help you grow through:

Click here to learn more...