Keeping Your Data Safe

4. Data Use

4.1 Only give each of your employees access to the data they need.

• If your staff cannot access data, they cannot change or delete it - whether deliberately or by mistake.
• Make sure every employee has access to the data they need to do their job.

4.2 Use secure logins to provide different access levels.

• Give each member of staff their own username and password.
• Microsoft Windows allows you to grant different access levels to particular groups or individual users.
• Make sure other business software allows you to set up staff logins too.
• Can your customer relationship management (CRM) software allow different users different levels of access?
• Mobile access can be a headache.Consider providing a virtual private network (VPN) so employees can securely connect to your company systems from outside the business.

4.3 Ensure everyone in your business understands the importance of data protection.

• Systems and processes alone are not enough to keep data secure.
• Your staff have access to the data, so they must take responsibility for it (see 6).

4.4 Have clearly-defined methods for transferring data.

• Data is vulnerable when in transit, whether being sent across the Internet or by post on a disk.
• Always encrypt important data before tranferring it.
• Enable security protocols such as SSL and IPSec when tranferring data on the Internet.
• If you are transferring data outside your business, make sure you are in compliance with data protection legislation, and that the recipient understands how they can use it.
• Make sure additional copies of data are only held for as long as necessary - whether inside or outside your company.

4.5 When deciding how data should be accessed, you may need to strike a balance between security and convenience.

• Adding too many security measures can make it harder for employees to do their jobs, and encourage them to find shortcuts.
• For instance, employees with multiple passwords for multiple systems may write them down, ultimately reducing the security of those systems.
• To achieve a good balance, test out different security options and ask employees what they think.