The document discusses the importance of data protection and the impact of the General Data Protection Regulation (GDPR) on organizations in the EU, emphasizing the need for compliance and effective data handling practices. It also highlights the necessity of employee training on data protection, suggesting e-learning as a flexible, cost-effective method to educate staff on guidelines and responsibilities. The document outlines various types of data security and training methods that organizations can adopt to reinforce data protection measures.

1. Need for Data Protection Training
How E-learning Can Help?

2. Did you come across these recent
news items?
Source: http://www.theguardian.com/healthcare-network/2011/sep/07/south-manchester-foundation-trust-ico-memory-stick-loss

3. Source: http://www.theguardian.com/healthcare-network/2011/sep/07/south-manchester-foundation-trust-ico-memory-stick-loss
What do these items have
in common?

4. Source: http://www.theguardian.com/healthcare-network/2011/sep/07/south-manchester-foundation-trust-ico-memory-stick-loss
They are reports of data protection
breaches and their consequences.

5. What is Data Protection?

6. What is Data Protection?
Data protection refers to the process of
ensuring that individual data is safe and
protected by 'data-controllers'.
Data controllers are those entities or
individuals who handle individual information.

7. Currently, each country in the European Union has its own
Data Protection Authority such as the Information
Commissioner's Office (ICO) in the United Kingdom.

8. However, a draft General Data Protection Regulation
(GDPR) has been passed by the European Parliament, and
this unified and simplified data protection mechanisms
across 28 member states of the European Union (EU).

9. The draft regulation is likely to come into
effect in 2015.

10. Once the GDPR has been finalized and
becomes a law, all European as well as
non-European organizations functioning
in the EU region will need to adhere to its
guidelines.

11. What does
this mean to organizations?

12. It becomes imperative for organizations to review their
data processing policies & practices and align them with
the new regulation.

13. What are the measures that
organizations need to take to ensure
compliance to GDPR?

14. Organizations need to have
transparent and well laid out processes
to handle data protection.

15. Good information governance should be adopted that will
enable organizations to answer questions pertaining to data
protection such as data classification scheme, ownership of
company data, data controllers within the organization.

16. If organizations work with Cloud Service Providers
and Data Processors, they need to review the
contracts to incorporate the new guidelines.

17. Companies need to be mindful of the location of
their cloud data and measures taken for
Data Backup and encryption.

18. Organizations need to set up systems and
procedures to secure consent before collecting
and processing personal data.

19. Companies need to ensure that all employees
handling individual data are trained effectively so that
they conform to the norms laid down in the EU Data
Protection regulation.

20. What happens in case
of non-compliance?

21. Organizations can incur huge losses in terms of
fines, if found violating the Data Protection Act.
SOURCE: http://www.theguardian.com/technology/2013/jan/24/sony-fined-over-playstation-hack
http://www.theguardian.com/media-network/media-network-blog/2013/aug/19/nhs-surrey-data-breach-scandal

22. Organizations could face fines up to 100 million euros
or up to 5% of their worldwide turnover in case of
breaches of General Data Protection Regulation (GDPR).
SOURCE: http://www.theguardian.com/technology/2013/jan/24/sony-fined-over-playstation-hack
http://www.theguardian.com/media-network/media-network-blog/2013/aug/19/nhs-surrey-data-breach-scandal

23. What are the Key Principles
of General Data Protection
Regulation (GDPR)

24. Processing of personal data is lawful if it is in accordance
with the law and pursues a legitimate purpose
The principle of lawful processing

25. Need for data processing should be visibly defined and
adhered to. Deviations require additional legal basis.
The principle of purpose specification
and limitation

26. Provides guidelines on how data is to be handled and include
the data relevance principle, data accuracy principle and
limited retention of data principle.
Data quality principles

27. Provides guidelines for transparency of processing. It also
makes it mandatory to seek consent from individuals and
provides rights to individuals to access their data.
The fair processing principle

28. Spells out the need to implement measures by organizations
to promote and safeguard data protection and can be
subjected to audit by supervisory authorities
The principle of accountability

29. It needs an elaborate study and training to ensure that
employees understand and enforce the new regulations.

30. How can organizations prepare their
employees for the new data protection
regulation?

31. Employees are often found to be the weakest
connection in the data protection process.

32. This is not usually because they are
unaware of the rules and their
responsibilities in the regard.

33. Very often employees
Do not understand the implications
of data breach.

34. Employees need to be motivated and educated
to reinforce the data protection process and
procedures of the organization.

35. This can be done through effective training that
is directed towards providing information and
creating awareness of data breach implications.

36. What are the different types of data security
that employees need to be aware?

37. Physical Security
Information pertaining to workplace security such
as the desks, rooms, hard copies of data as in file
cabinets etc.

38. Desktop Security
Focus on protecting computers from unauthorized
access.

39. Password Security
Advice and training to set up a strong password
and adopt secure practices.

40. Wireless Network Security
Security threats and safety mechanisms when
using unsecured wireless networks.

41. Phishing
Deals with safeguarding personal information from
unsafe network communications.

42. File Sharing
Responsibilities when handling internal data
and sharing information to external personnel,
temporary workers, etc.

43. What is the best method to train
employees on data protection regulation ?

44. What is the best method to train
employees on data protection regulation
All employees need to understand the importance
of data protection to a certain extent.
?

45. What is the best method to train
employees on data protection regulation
There are many methods that one can adopt to
provide data protection training.
Organizations follow one or a combination of the
following methods.
?

46. Face to face classroom training
It may not be viable in case the number of
employees to be trained is large but can be used
for orientation or introduction by line managers.

47. E-learning
E-learning is a cost-effective and useful method to
roll-out enterprise-wide data protection security
within a short duration.

48. Security awareness information
posted on the intranet
While having this information is useful, it cannot
function as a stand-alone method as you cannot
be sure that employees have visited the site and
understood their responsibilities correctly.

49. Pushing helpful hints onto
computers when they start up
This is a very helpful reinforcement strategy
to enforce best practices.

50. E-mailing helpful hints on a
weekly or monthly basis
This too is excellent reinforcement strategy
post training.

51. Using visual aids like posters,
banners and info-graphics
Can be used as reminders and checklists at strategic
locations in the organization.

52. How E-learning Provides Effective Data
Protection Training to Your Employees?

53. Provides flexibility and choice
Ensures employees complete the course at their
convenience when they are more receptive to the
knowledge.

54. Ensures wider reach
Organizations can train more employees within less
time as courses can be developed and hosted on
the LMS, which can be accessed by anyone.

55. Scenarios and Case studies can be used to make
the content relevant to on the job situation.

56. Assessments help to ensure
accurate understanding
Employees can evaluate and test their understanding
with formative and summative assessments.

57. Assessments help to ensure
accurate understanding
Employees can evaluate and test their understanding
with formative and summative assessments.

58. Tracking and Record keeping of
trainings administered is easy
Records of training can be made available to
regulatory authorities easily with courses deployed
via LMS.

59. Data Protection Training is important and
eLearning could be a viable, cost-effective
method to ensure employees are trained
smoothly and quickly.
Summ
ary