The European Data Protection Board recently requested comments on
its data protection "by design and default" guidelines.
Comments are due by mid-January of next year. The Guidelines provide clarity
about how to address GDPR's requirement that companies take
"appropriate" technical and organizational steps to
protect personal information and individuals. Part of the law's
requirements, according to the guidelines, is that companies can
show that the measures they took are effective.
The guidelines stress that measures taken must be appropriate
and integrate "necessary safeguards" into the processing
of personal information. Measures might range from training to use
of advanced technical tools. Examples of potentially appropriate
safeguards might include, according to the Guidelines, data
deletion reminders, malware detection systems, pseudonymization of
data, or training employees about phishing. Important to the EDPB
is that companies can demonstrate that the
