Piergiorgio Venuti
GDPR: what’s new and what’s old
GDPR 2018: what’s new and what’s old.
In my work as a privacy professional I have dealt with companies and public administrations that – those with more effort and effort, those with less – have tried to adapt to the so-called “privacy” regulations that have taken place over the last twenty years. But when I happened to meet these companies after a while, I discovered that all those efforts – big or small they were – had no following: a magnificent castle was built but no maintenance was done , and that castle fell to pieces, in some cases it no longer exists and many do not know if it ever existed.
So when I think of the GDPR and all those who are concerned with the changes that this introduces and the investments that will need to be made to adapt, in short, when my clients ask me how much this new castle will cost them, I would rather say than think what will be needed to invest in building the castle (new software, new technologies) will be more important to think about later, how to organize and maintain their processes, how to keep their people up to date, how to verify, monitor that data are treated in the respect for the principles, that the effectiveness of the security measures is always adequate in relation to the evolution of the threats and the new treatments that the companies put in place.
Yes, because in the GDPR there is little new as to prescriptions (the GDPR has not so much prescriptive character), there is instead a lot of new in terms of principles and responsibilities.
One of the key principles of the GDPR 2018 is in fact that of accountability, of accountability.
In fact, the Owner is responsible for any decision on the appropriate measures to be prepared, and the measures are established on the basis of the results of the risk analysis (and this is not new, remember the DPSS whose compulsory had been canceled in our legal system?). And the risk analysis must be done on the treatments, it is necessary to draw up a Register of Treatments (The DPSS foresaw a census of the treatments, even here nothing new …).
But security measures, treatment processes, are not something static. Moreover it may happen that not all organization is constant in applying principles and measures in daily practice.
Here then the GDPR requires that the effectiveness of the measures is monitored, that the application of the principles is verified: this has only one name, which in the Italian version of the GDPR has been translated in an abrupt manner in three different ways. This name is AUDIT: here’s what you have to keep doing.
And much attention must also be done when designing new measures, new treatments: it will be necessary to respect the key principles of privacy by design and privacy by default.
And for the most risky treatments (those that are operated on data that are risky for the freedom and dignity of the data subjects, health data, biometric data, genetic data …), an Impact Assessment must be carried out before starting the treatment. The current legislation provides for a notification to the Guarantor, an act that is usually only bureaucratic: the GDPR asks for something more complicated, which goes to intersect with the principle of accountability: it is always the owner who is responsible for carrying out an evaluation impact and decide on the measures.
In conclusion, in GDPR 2018 there is a lot of old, already present in the current legislation, although in some cases a bit ‘hidden between the lines, but often less hidden in the measures of the Guarantor. The real news, as we have seen, lies in the responsibility, in the need – even in the obligation – to do maintenance, and it is precisely there that also go to fit the new (those yes!) And much heavier penalties.
Paolo Raimondi, Privacy Officer and Privacy Consultant
GDPR 2018
[btnsx id=”2931″]
Useful links:
Introducing a set of new GDPR tools
New European regulation (GDPR)
Stay in control of your fast-moving, quick-shifting data
Share
RSS
More Articles…
- From Cyberfero to Cyberfero: rebranding of the leading cybersecurity company
- NIS: what it is and how it protects cybersecurity
- Advanced persistent threats (APTs): what they are and how to defend yourself
- Penetration Testing and MFA: A Dual Strategy to Maximize Security
- Penetration Testing: Where to Strike to Protect Your IT Network
- Ransomware: a plague that brings companies and institutions to their knees. Should you pay the ransom? Here is the answer.
- Why IT audit and log management are important for Cybersecurity
- Red Team, Blue Team and Purple Team: what are the differences?
Categories …
- Backup as a Service (18)
- Acronis Cloud Backup (11)
- Veeam Cloud Connect (4)
- Cloud Conference (3)
- Cloud CRM (1)
- Cloud Server/VPS (22)
- Conferenza Cloud (4)
- Cyberfero (15)
- ICT Monitoring (5)
- Log Management (2)
- News (25)
- ownCloud (4)
- Privacy (7)
- Security (203)
- Cyber Threat Intelligence (CTI) (8)
- Deception (4)
- Ethical Phishing (11)
- Netwrix Auditor (2)
- Penetration Test (11)
- Posture Guard (3)
- SOCaaS (65)
- Vulnerabilities (84)
- Web Hosting (15)
Tags
Unknown Feed
Full Disclosure
- A project is publishing full analyses of AI-discovered 0-days - first batch of 10 with reproducible exploits July 23, 2026Posted by zz lin on Jul 22I came across a project, "0day Rubbish", that states it will continuously disclose 0-day vulnerabilities discovered by an AI-driven research process (a multi-LLM ensemble of Claude, OpenAI, DeepSeek and GLM). For each vulnerability the project publishes a full technical analysis together with a working exploit script and step-by-step reproduction […]
- Synology stale DNS allows practical interception of traffic from vulnerable DSM clients July 23, 2026Posted by shed riot on Jul 22# Synology stale DNS allows practical interception of traffic from vulnerable DSM clients Vendor case: 904909 Suggested severity: High ## Customer advisory Synology customers using the affected DSM and Relayd versions listed below should upgrade immediately. The relevant man-in-the-middle vulnerabilities were fixed in DSM 6.2.3-25426 Update 3. Customers should […]
- Amplitude customers using domain proxies should update their configuration immediately. July 23, 2026Posted by shed riot on Jul 22After receiving live analytics requests intended for `api2.amplitude.com`, I contacted `security () amplitude com` and was invited to submit the issue through Amplitude's private Bugcrowd programme. In my view, Amplitude's handling of the report, including closing it as "Not applicable" despite evidence of intercepted customer traffic, caused by insecure […]
- ASUS bsitf.sys (CVE-2026-13585): Arbitrary Physical Memory Mapping in ASUS Business/Software Manager kernel driver July 21, 2026Posted by Hayaturehman Ahmadzai on Jul 20Hi all, I'm disclosing a vulnerability (CVE-2026-13585) in the ASUS bsitf.sys / AsusBSItf.sys kernel driver, shipped with ASUS Business Manager and Software Manager. ASUS has assigned the CVE and published a vendor advisory with countermeasures. Summary: The driver exposes a device (\\.\bsitf, admin-required to open) with an IOCTL that […]
- New Release: UFONet v2.0 - "R3DST4R!"... July 21, 2026Posted by psy on Jul 20Hi Community, I am glad to present a new release of this tool: - https://ufonet.03c8.net --------- "UFONet is a free software, P2P and cryptographic -disruptive toolkit- that allows to perform DoS and DDoS attacks; on the Layer 7 (APP/HTTP) through the exploitation of Open Redirect vectors on third-party websites to […]
- XSSer v.1.9 - "Bl4ck Swarm!" released July 21, 2026Posted by psy on Jul 20Hi FD, I am glad to present a new release of this tool: - https://xsser.03c8.net --------- "Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications. It provides several options to try to bypass certain filters and various special techniques for […]
- NotCVE registry index — public records of vulnerabilities that shipped without a CVE July 21, 2026Posted by NotCVE Advisories on Jul 20---------------------------------------------------------------------------- NotCVE Registry Index — 2026-07-16 ---------------------------------------------------------------------------- [-] About the NotCVE registry: NotCVE (https://notcve.org) assigns public identifiers to real, verifiable vulnerabilities that did not receive a CVE — typically because the affected vendor did not acknowledge the issue. Each record preserves the technical...
- [NotCVE-2026-0001] Cloudflare Universal SSL CAA augmentation weakens RFC 8657 account binding — CVE-2026-14440 assigned 163 days after public no-CVE disclosure July 16, 2026Posted by NotCVE Advisories on Jul 15---------------------------------------------------------------------------- NotCVE Disclosure Update — NotCVE-2026-0001 / CVE-2026-14440 ---------------------------------------------------------------------------- [-] Summary: On 2026-01-19 the issue described below was published as NotCVE-2026-0001 after no CVE identifier was assigned for it. On 2026-07-01 — 163 days later — Cloudflare assigned CVE-2026-14440 to the same issue, now...
- Subject: Advisory Submission: EZ Game Booster - Cleartext Storage of Sensitive Credentials (CWE-312) July 16, 2026Posted by AliReza on Jul 15# Exploit Title: EZ Game Booster v1.0.0 - Cleartext Credentials in user.config # Date: 2026-07-16 # Exploit Author: Alireza Chegini # Vendor Homepage: https://ezsystemrepairs.com # Software Link: https://ezsystemrepairs.com (Free version available) # Version: 1.0.0 (v2.0 exists but not tested - paid license required) # Tested on: Windows 10 / Windows […]
- CVE-2026-56877 - Skillable SCORM userId authorisation bypass July 16, 2026Posted by Greg via Fulldisclosure on Jul 15Skillable's SCORM lab launch endpoint validates a launch token but enforces per-user allocation limits using a browser-supplied userId that is not bound to the validated token. An authenticated learner can modify this identifier to bypass configured limits, launch concurrent lab instances, and consume another learner's allocation. Skillable states […]
Customers
Twitter FEED
Recent activity
-
SecureOnlineDesktop
Estimated reading time: 6 minutes L'impatto crescente delle minacce informatiche, su sistemi operativi privati op… https://t.co/FimxTS4o9G
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The growing impact of cyber threats, on private or corporate operating systems… https://t.co/y6G6RYA9n1
-
SecureOnlineDesktop
Tempo di lettura stimato: 6 minuti Today we are talking about the CTI update of our services. Data security is… https://t.co/YAZkn7iFqa
-
SecureOnlineDesktop
Estimated reading time: 6 minutes Il tema della sicurezza delle informazioni è di grande attualità in questo peri… https://t.co/tfve5Kzr09
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The issue of information security is very topical in this historical period ch… https://t.co/TP8gvdRcrF
Newsletter
Products and Solutions
Partners
Cloud Models
News
- From Cyberfero to Cyberfero: rebranding of the leading cybersecurity company May 6, 2024
- NIS: what it is and how it protects cybersecurity April 22, 2024
- Advanced persistent threats (APTs): what they are and how to defend yourself April 17, 2024
- Penetration Testing and MFA: A Dual Strategy to Maximize Security April 15, 2024
- Penetration Testing: Where to Strike to Protect Your IT Network March 25, 2024
Google Reviews
Davvero consigliata !!!!!
In particolare vorrei sottolineare la figura che piu’ racchiude e sintetizza le qualità della Secure Online Desktop , il suo AD Ing. Piergiorgio Venuti, professionista impagabile , sia dal punto di vista tecnico/organizzativo che soprattutto (e non dimeno) come persona , capace di gestire , risolvere e approcciare qualsivoglia attività/problematica, davvero un grande !!!!
Tempi veloci e staff preparato!
Ottima azienda, servizi molto utili, staff qualificato e competente. Raccomandata!read more
Ottimo supportoread more
E' un piacere poter collaborare con realtà di questo tiporead more
Un ottimo fornitore.
Io personalmente ho parlato con l' Ing. Venuti, valore aggiunto indubbiamente.read more
About
© 2024 Cyberfero s.r.l. All Rights Reserved. Sede Legale: via Statuto 3 - 42121 Reggio Emilia (RE) – PEC [email protected] Cod. fiscale e P.IVA 03058120357 – R.E.A. 356650 Informativa Privacy - Certificazioni ISO