Analysis of Information Security Measures Embedded in the GDPR

This paper takes a viewpoint of the information security officer whose task is to ensure the optimal level of privacy protection for personal information that the organisation processes. We analyse the requirements of the EU's General Data Protection Regulation (GDPR) with the aim of finding out whether all the main aspects of information security management process (prevention, detection, response and recovery) are covered in a well-balanced manner. Our main finding is that recovery is under-emphasised in the GDPR compared to the other aspects.