Illegitimate Data Protection Requests - To Delete or to Address?
summary
Attackers send weaponized data‑subject requests that carry executable attachments or obfuscated PDFs that drop credential‑stealing malware, and a 2019 study of ~150 orgs finds ~70% of midsize targets unlawfully comply. Vulnerabilities are shared inboxes, skipped identity checks, poor training and missing DLP/appsec gating. Practical defenses are strict verification workflows, route requests only to the privacy team, email‑attachment scanning and quarantine as a second set of eyes, enforced least privilege, and mandatory logging and DPIAs to block these misuse cases.
AI-written summary · about
chapters (19)
- 0:00Introduction and speakers
- 0:50Data protection fundamentals
- 6:48Operational security measures
- 10:34Privacy by design
- 12:31Data subject access requests
- 15:41Requests as attack vectors
- 18:02Organizational vulnerabilities
- 20:10The human firewall
- 20:53Effective communication
- 21:34Making training engaging
- 22:21Policy writing tips
- 22:59Technology and security
- 24:14Application security costs
- 25:30Rational versus impulse
- 25:48Balancing interests
- 28:40Key conclusions
- 29:03Threat awareness
- 29:45Technology for protection
- 32:05Q&A session
related talks
22mGDPArrrrr: Using Privacy Laws to Steal Identities
22mPersonal Information Leakage by Abusing the GDPR 'Right of Access'
38mThe Devil's in the Data: Role of Data Governance in Cyber Risk Mitigation
31mDemystifying Data Protection: Steps To Find, Monitor And Control Without Chaos
40mA Data Protection Problem: Insider Risk
26mPrivacy Issues in Big Data Processing in light of Data Breaches
01h 59mDeep Dive Workshop – Data Security and Data Protection
29mManaging Privacy and Cyber In A Pandemic: Lessons Learned For 2021 & Beyond