| Name: | Description: | Size: | Format: | |
|---|---|---|---|---|
| 824.14 KB | Adobe PDF |
Advisor(s)
Abstract(s)
Em 2016, a União Europeia criou o Regulamento Geral sobre a Proteção de Dados (RGPD), com aplicação obrigatória em toda a União Europeia a partir de 25 de maio de 2018, tendo gerado um forte debate em torno da proteção de dados, em particular os dados pessoais. Ao se considerarem medidas impostas por lei como o Direito de Acesso, o Direito ao Apagamento de Dados e o Direito de Retificação dos dados pessoais, torna-se necessária a existência de mecanismos que assegurem a conformidade dos Sistemas de Informação (SI) perante tais imposições.
De modo a assegurar que as organizações sigam as diretrizes do RGPD é encorajada a realização de Avaliações de Impacto sobre a Proteção de Dados de modo a serem visíveis as mudanças nas necessidades de segurança dos SI das organizações.
No âmbito do Mestrado em Informação Empresarial foi realizado um estágio do qual resultou o presente relatório. O estágio foi realizado durante cerca de seis meses e meio, no edifício central da Administração dos Portos do Douro, Leixões e Viana do Castelo, S.A., inserido na Divisão de Proteção de Dados e Gestão de Risco Empresarial. Tendo como foco a proteção dos dados pessoais usados nas atividades da organização foram definidos dois objetivos principais. Por um lado, analisar e avaliar as práticas e os mecanismos de segurança de cada SI utilizados dentro da organização e, por outro lado, verificar o nível de conformidade da implementação das diretrizes do RGPD.
Durante este estágio foram avaliados oito SI, alguns interligados, mas todos com processos e finalidades diferentes, concluiu-se que, de uma forma geral, se verifica um aumento no nível de segurança dos SI, e que, apesar de serem necessárias alguns ajustes, também existe um elevado nível de conformidade quanto à aplicação das diretrizes do RGPD.
In 2016, the European Union created the General Data Protection Regulation (GDPR), with mandatory application throughout the European Union starting 25 May 2018, it generated a strong debate around data protection, in particular personal data. When considering measures imposed by law such as the Right of Access, the Right to Erase Data and the Right to Rectify Personal Data, it is necessary to have mechanisms that ensure the compliance of the Information Systems (IS) with such rules. In order to ensure that organizations follow the guidelines of the RGPD, it is encouraged to carry out Impact Assessments on Data Protection (AIPD) in order to know what changes are needed in the organization’s IS. Within the scope of the Master in Business Information, an internship was carried out for which this document serves as a report. The internship was carried out for about six and a half months, in the headquarters of Administração dos Portos do Douro, Leixões e Viana do Castelo, S.A., inserted in the Data Protection and Business Risk Management Division. Focusing on the protection of personal data used in the organization's activities, two objectives were defined. On the one hand, analyze and evaluate the practices and security mechanisms of each IS used within the organization and, on the other hand, verify the level of compliance of the implementation of the GDPR guidelines. During the internship eight IS were evaluated, some interconnected, but all with different processes and purposes. It was concluded that overall there is an increase in the security level of the IS, and that, although some adjustments are necessary, there is also a high level of compliance with GDPR guidelines.
In 2016, the European Union created the General Data Protection Regulation (GDPR), with mandatory application throughout the European Union starting 25 May 2018, it generated a strong debate around data protection, in particular personal data. When considering measures imposed by law such as the Right of Access, the Right to Erase Data and the Right to Rectify Personal Data, it is necessary to have mechanisms that ensure the compliance of the Information Systems (IS) with such rules. In order to ensure that organizations follow the guidelines of the RGPD, it is encouraged to carry out Impact Assessments on Data Protection (AIPD) in order to know what changes are needed in the organization’s IS. Within the scope of the Master in Business Information, an internship was carried out for which this document serves as a report. The internship was carried out for about six and a half months, in the headquarters of Administração dos Portos do Douro, Leixões e Viana do Castelo, S.A., inserted in the Data Protection and Business Risk Management Division. Focusing on the protection of personal data used in the organization's activities, two objectives were defined. On the one hand, analyze and evaluate the practices and security mechanisms of each IS used within the organization and, on the other hand, verify the level of compliance of the implementation of the GDPR guidelines. During the internship eight IS were evaluated, some interconnected, but all with different processes and purposes. It was concluded that overall there is an increase in the security level of the IS, and that, although some adjustments are necessary, there is also a high level of compliance with GDPR guidelines.
Description
Keywords
Dados pessoais RGPD Avaliações de conformidade de segurança Personal data GDPR IADP Security compliance evaluation