There is no beating around the bush: the entry into force of the General Data Protection Regulation (GDPR) on 25 May 2018 forced many companies and public institutions to reconsider their approach to data security. If you handle the personal data of EU citizens—whether you obtained it directly from them or process it for another company—you must now be much more thorough in protecting it. If you fail to comply with the new rules, you risk a hefty fine: EUR 10–20 million or 2–4% of annual revenue, whichever is higher.
One of the requirements of the GDPR is to establish robust measures to protect against security breaches caused by cybercriminals or other actors with malicious intent. If you suffer a security breach, you are required to notify the relevant authorities and inform the affected customers. Considering that ransomware attacks have newly been assessed as the most serious threat to enterprise data security (see the Verizon 2018 Data Breach Investigation Report), you can conclude that your experience with GDPR compliance will depend primarily on how well you can protect EU customers' personal data against ransomware attacks.
To illustrate this more clearly, we created a short story about two companies that must comply with GDPR rules: one actively protected itself against ransomware attacks, while the other did not do so nearly as much. As you will see, one scenario is much more pleasant than the other.
You can find the comic here.
Article author: ZEBR.ai editorial team
