GDPR – What you need to know:
The Data Protection Act 2018 is the UK’s implementation of the General Data Protection Regulation (GDPR).

Anyone who uses personal data must follow ‘data protection principles’ and ensure the information is used fairly and within the law. Personal data must only be used for specified purposes and needs to be limited to what is necessary. Find out more about the Data Protection Act 2018 here.

Minimise the Risks
Employees who work from home and that handle personal data must be fully trained on GDPR and how it affects their working practices. All employees must use strong passwords – it’s hard to keep track of passwords so password managers are a great tool to keep them safe and secure. Encourage your employees to use a VPN (virtual private network) when working from home as an extra layer of security.

The use of company devices is the most expensive option (but most secure) for employees who work remotely. The devices should be able to be supported and updated remotely and measures should be put in place to prevent data loss.

If your employees wish to use their own devices for working from home there are considerations you need to take into account before authorising in order to help prevent data protection and security breaches:

• Ensure your employees have up to date software (including operating system).
• Bear in mind the likelihood of family members or other members of the household seeing sensitive data.
• Do other members of the household share the devices? If so, how can you ensure sensitive data is not shared?
• Encrypt sensitive company data – there are multiple third party hard drive encryption software solutions.
• Discourage the practice of storing or transferring sensitive data to insecure storage devices such as USB sticks.

Security Checklist:

• Up to date policies for remote working.
• Make sure all your employees (and you) are fully trained on data protection and how to remain secure when working remotely.
• Guidance on working remotely for all employees.
• Ensure all employees use strong passwords and utilise multi-factor authentication where possible.
• Ensure employees use company email addresses when dealing with sensitive data.
• Control access so that employees only have access to the data they need and nothing more.
• Ensure all employees have up to date antivirus software installed (and turned on) on any personal device being used for work.
• Ensure you use a corporate VPN to keep connections secure.

​
When Employees Leave
To protect against data loss you need to make sure you remove access to the company email address immediately. Remove access to all applications and disable, retrieve and wipe any company owned devices.

On leaving, ask the employee to sign a document acknowledging they have returned any company owned devices and that they haven’t kept any company data.

Most spam and scam emails will be caught by your email client but one or two are clever enough to creep in to your inbox. Would you know how to spot them if they do? These seven points should help you…
 

1. How does the sender greet you? Do they use your first name, or Mr/Mrs XXX? Or do they do something rather odd such as using the first part of your email address? For example: if your email address is [email protected], they might use ‘Dear ANOther’. This is a classic warning sign that the email might come from an untrustworthy source and you should not open it.
2. Poor spelling or grammar – does the email read as though it has been generated by a machine, or translated from another language? Are there spelling errors? Leave these emails well alone.
3. Is the email pressurising you into giving your password or any personal details? NEVER click on anything in such an email, ditch it immediately.
4. If you have not entered a competition, you can’t possibly have won a prize, no matter how amazing it seems. In general, if it seems too good to be true, it usually is.
5. If you are not expecting a delivery, don’t open any delivery notes, or invoices, especially if they come from a company you have never used.
6. Likewise, the Inland Revenue and other government departments will not use email as a first point of contact with you, if you have not recently been talking to them in some other way, don’t open emails purporting to be from them. More Info >
7. Scammers will often use an email address that looks similar to one you might use, but always look very carefully at them. The section after the @ symbol can be very telling, for instance a British company will usually have an email address ending in .co.uk or .org.uk  If it looks odd… it probably is.

 
In short, use your common sense and if an email doesn’t look right, leave well alone. It’s better to ignore an email and then receive another form of communication from a genuine sender than to open a scam email and have it corrupt your computer.

'Scam or Phishing Emails and 7 Ways to Spot Them’ - written for File Genie by Freelance Writer Ruth Raymer @WritingWalking