Summary of IT Professional Skills and Sustainability

## Introduction Data protection is the set of practices, laws, and technical measures that keep personal information safe, private, and used only for legitimate purposes. This guide focuses on practical responsibilities for people who design, operate, or maintain systems that store or process personal data. > **Definition:** Personal data is any information that can identify a living person, such as name, email, IP address, cookies, location data, health details, or biometric identifiers. ## What is GDPR? GDPR stands for **General Data Protection Regulation**, an EU law effective since May 2018. It applies to any organization processing personal data about people in the EU. GDPR requires organizations to protect personal data, document how they do it, and respond quickly if something goes wrong. ### Quick analogy A doctor must keep your medical record confidential. GDPR applies the same principle to organizations that collect personal data digitally: treat it with care, secure it, and do not share it without a valid reason. ## Core Principles of Data Protection GDPR is built on seven core principles. For each, here is what it means and a short technical implication. | Principle | What it means | Practical IT implication | | --- | ---: | --- | | Lawfulness | You need a legal reason to collect data | Record legal basis (consent, contract, legal obligation) in system metadata | | Purpose limitation | Collect data only for a specified purpose | Tag data with purpose; refuse unrelated reuse | | Data minimization | Only collect what is necessary | Limit form fields and API responses to required attributes | | Accuracy | Keep data correct and up to date | Provide editing workflows and sync checks | | Storage limitation | Do not keep data longer than necessary | Implement retention policies and automated deletion | | Security | Protect data from unauthorized access | Apply access controls, encryption, and monitoring | | Accountability | Be able to prove compliance | Maintain logs, policies, and documentation | > **Definition:** Data minimization means collecting only the personal data strictly necessary for a specific purpose. Did you know that GDPR fines can reach up to 4% of global annual turnover or €20 million, whichever is higher? ## Practical Responsibilities for IT Workers IT staff are essential to GDPR compliance because they build and maintain the systems that hold personal data. Core tasks include: - Secure storage: enforce role-based access and least-privilege for databases and file stores. - Encryption: encrypt sensitive data in transit and at rest using well-maintained algorithms and key management. - Access logs: keep detailed logs of who accessed which records and when; retain logs per policy. - No unnecessary sharing: never email personal data to people without a business need; avoid personal cloud storage for company data. - Data deletion: follow retention rules and delete or anonymize data when required. - Breach reporting: if personal data is leaked, report to the Swedish Data Protection Authority (IMY) within 72 hours when there is a risk to individuals. > **Definition:** A data breach is unauthorized access to, loss of, or theft of personal data. Fun fact: Proper logging and monitoring significantly shorten breach investigations and are often the difference between meeting the 72-hour reporting requirement or failing to do so. ## Detecting and Responding to Data Breaches Steps to handle a suspected breach: 1. Detect the breach: rely on monitoring, alerts, and access logs. 2. Assess the risk: whose data, how many people, sensitivity level, scope of exposure. 3. Contain and remediate: block further access, patch vulnerabilities, revoke compromised credentials. 4. Report to IMY within 72 hours if breach likely risks individuals. 5. Notify affected individuals when the breach poses a high risk to their rights. 6. Review and improve controls to prevent recurrence. Table: Typical breach vectors and i