Privacy is a process, not a single setting
Privacy protection covers lawful, fair and transparent processing of personal data: defined purposes, minimisation, accuracy, retention and individual rights. IT safeguards support these principles but do not replace them. The organisation must also demonstrate accountability.
Data and classification
A company needs to know what data is personal, confidential, financial, technical or operationally critical.
Identity and access
MFA, roles, permission reviews and revoking access reduce the risk of account compromise.
Systems protection
Endpoints, network, email, backup and monitoring must support the privacy policy and not operate separately.
What can violate user or customer privacy
A breach may not only be a database leak. Another problem is excessive employee access permissions, a public link to the document, failure to delete the account after leaving the company, uncontrolled report export, an application collecting too much data or logs containing personal information without defined retention periods.
Public release
A link, folder or repository can reveal data even without a classic hack.
Account theft
Taking over a mailbox or administrator account often gives access to multiple systems at the same time.
No retention rules
Data stored without purpose increases the impact of an incident and complicates GDPR compliance.
Invisible suppliers
Subcontractors, SaaS tools, and API integrations may process data outside of the company's primary control.
Violation of user data privacy online
The Internet user leaves behind technical and behavioural data: IP address, cookie identifiers, device parameters, history of visited websites, browser language, operating system, time zone and screen resolution. Combined with fingerprinting, this allows you to create an activity profile and distinguish a person even if they have not provided their name and surname.
- Cookies and session identifiers show when you return to the site, what products you view and how you navigate around the site.
- Fingerprinting combines browser, device and network parameters to create a technical fingerprint similar to a user profile. Before deploying tracking, assess applicable electronic-communications and data-protection requirements with the privacy lead, including notice and any consent requirement; technical identification capability does not establish permission to track.
- Public links, misconfigured forms, and redundant logs can expose data without a classic hack.
- Companies should limit the scope of data collection, log retention and access to analytical and marketing tools.
Cloud privacy breach
Migrating data to the cloud does not relieve a company of its responsibility for privacy. The difference between a local and cloud database is the division of responsibilities: part of the security is provided by the platform provider, but the configuration of accounts, permissions, backup, retention, encryption and shares usually remains with the organisation.
Local database
The company has more control over the server, administrators and the network, but is responsible for hardening, backup and monitoring itself.
Cloud database
The responsibility model depends on the service: SaaS, PaaS or IaaS. Configuration errors can still compromise privacy.
Shared responsibility
The provider protects the platform and the company must control identity, access, data, retention, integrations and evidence.
When is an incident a personal data breach?
Not every IT incident is a personal data breach. A breach involves accidental or unlawful destruction, loss, alteration, disclosure of or access to personal data. It can affect confidentiality, integrity or availability. Assess the scope, consequences for individuals and obligations under GDPR Articles 33–34.
- The controller notifies the authority without undue delay and, where feasible, within 72 hours of awareness, unless risk to individuals’ rights and freedoms is unlikely. Explain any delay.
- High risk to individuals requires communication to them without undue delay, subject to the exceptions in GDPR Article 34.
- A processor notifies the controller of a breach without undue delay.
- Document every breach, its effects, risk assessment and response, including breaches not notified to the authority.
A practical decision map for privacy protection
First, you need to determine which data is critical and where it is processed. Only then does the selection of tools make sense. Otherwise, the company invests in security measures that do not protect critical information.
- Data: Identify data categories, locations, owners, processing bases and required retention periods.
- Access: Check privileged accounts, MFA, roles, groups, inactive accounts, and the process for revoking privileges.
- Systems: evaluate email, endpoints, cloud, backup, logs, SaaS applications, API integrations and mobile devices.
- Evidence: Maintain records of reviews, decisions, incidents, backup tests and corrective actions.
A phased action plan for a company that wants to sort out privacy
Address urgent data exposure, weak access and incident-response gaps from the outset. Statutory deadlines take priority. The following 30/60/90-day reviews measure programme progress; they do not postpone safeguards or breach notification.
30-day review: data map
Confirm processes, lawful bases, suppliers, owners and removal of urgent exposures.
60-day review: control effectiveness
Verify MFA, permissions, retention, backups and handling of individual rights.
90-day review: maintenance
Review findings, response exercises, register accuracy and remaining risks.
How Virtline helps protect your privacy
Virtline looks at privacy through the lens of infrastructure, cybersecurity and compliance. We check whether data is visible only where it should be, whether accounts are protected, whether backup works, whether logs are useful and whether the company has the audit evidence needed by the management, the client or the auditor.
Security audit
We assess email, access, endpoints, network, backup, monitoring and vulnerabilities affecting privacy.
Compliance and procedures
We help organise responsibility, evidence, retention and procedures for company data.
Ongoing IT support
We maintain controls over time: accounts, licences, security, alerts and response to reports.
Services to verify next
If privacy is an operational issue, it makes sense to combine legal compliance work with a technical review of the environment.
Data classification
Organising data, owners, categories, retention and information flows.
Cybersecurity
Technical security, monitoring, vulnerabilities, endpoints, email and incident response.
Contact
We will determine whether an audit, implementation of controls or permanent maintenance is needed.
Privacy must work in systems, not only in documents
Call +48 12 200 27 10 if your company stores personal data in email, Teams, SharePoint, on-premises systems, backups or cloud tools. Virtline helps identify processing locations, owners, risks and immediate controls.
- The technical review covers agreed systems, access and control evidence.
- findings from privacy audits and access-control reviews
- result: a data map, priorities, decision owners and a privacy-control action plan
Services supporting privacy protection
Data privacy requires a coordinated approach to classification, MFA, Microsoft 365 and cybersecurity.
Data classification
Data classes, owners, retention periods and sharing rules.
MFA
Protecting accounts that provide access to personal data and documents.
Microsoft 365
Control over Teams, SharePoint, email, retention, guests and audit logs.
