With cyber attacks regularly in the news, we are reminding businesses to check they have the appropriate security measures in place to protect personal information.

Businesses experienced an estimated 7.7 million cyber crimes over the past year, according to government figures. Most small businesses hold personal information and conduct business digitally, so cyber security must be a priority.

Ian Hulme, Executive Director for Regulatory Supervision at the ICO, said:

“Cyber attacks have been hitting the headlines again recently, serving as a timely reminder for all businesses to check their own security measures. When people share their personal information with your company, they need to feel confident you’ll do as much as possible to keep that information secure.

“While cyber attacks can be very sophisticated, we find that many organisations are still neglecting the very foundations of cyber security. As the data protection regulator, we want to support organisations to get this right and these simple steps will help to protect both your customers and your business.” 

Here are some practical steps businesses and their staff can take to improve their data security and resilience:

1. Back up your data
   • You should back up your data regularly. If you’re using an external storage device, keep it somewhere other than your main workplace – encrypt it, and lock it away if possible.
   • Check your back-up. You don’t want to find out it’s not worked when you need it most. Make sure your back-up isn’t connected to your live data source, so that any malicious activity doesn’t reach it.
2. Use strong passwords and multi-factor authentication 
   • Make sure you use strong and unique passwords, which are difficult to guess, on all account and devices where personal information is stored. The National Cyber Security Centre (NCSC) recommends using three random words.
   • Where possible, you should consider using multi-factor authentication. Multi-factor authentication is a security measure to make sure the right person is accessing the data. It requires at least two separate forms of identification before access is granted.
3. Be aware of your surroundings
   • Be careful what you say and what documents are open on your screen when people are around you, particularly if you’re in a public place where people can easily see you and overhear your conversations.
4. Be wary of suspicious emails
   • You and your staff need to know how to spot suspicious emails. Look out for signs such as bad grammar, demands for you to act urgently and requests for payment. New technologies mean that email attacks are becoming more sophisticated. A phishing email could appear to come from a source you recognise. If you’re not sure, speak to the sender.
5. Install anti-virus and malware protection And keep it up-to-date.
   • You must make sure the devices you and your employees use at home, or when you’re working away, are secure. Anti-virus software can help protect your device against malware sent through a phishing attack.
6. Protect your device when it’s unattended
   • Lock your screen when you’re temporarily away from your desk to prevent someone else accessing your computer. If you do need to leave your device for longer, put it in a secure place, out of sight.
7. Make sure your Wi-Fi connection is secure
   • Using public Wi-Fi, or an insecure connection, could put personal data at risk. You should make sure you always use a secure connection when connecting to the internet. If you’re using a public network, consider using a secure Virtual Private Network (VPN).
8. Limit access to those who need it
   • Different workers may need to use different types of information. Put access controls in place to make sure people can only see the information they need. If someone leaves your company, or if they’re absent for a long period of time, suspend their access to your systems.
9. Take care when sharing
   • Sharing your screen in a virtual meeting may show your device to others exactly as you see it, including any open tabs or documents. Before sharing your screen, you should close anything you don’t need and make sure your notifications and pop-up alerts are switched off.
   • Be careful when sending emails to multiple people. If an email may reveal sensitive information about the recipients, use alternatives to the blind carbon copy (BCC) email function such as bulk email or mail merge services.
10. Don’t keep data for longer than you need it
    • Getting rid of data you no longer need will free up storage space. This also means you have less personal information at risk if you suffer a cyber-attack or personal data breach.
11. Dispose of old IT equipment and records securely
    • You must make sure no personal data is left on laptops, smartphones or any other devices, before you dispose of them. You could consider using deletion software or hire a specialist to wipe the data.

If an organisation experiences a data breach as a result of a cyber attack, they should report it to us within 72 hours of becoming aware of it.

For more advice on protecting personal information, visit our security guidance for organisations.

For further support on cyber security, visit the National Cyber Security Centre’s website and the Cyber Essentials programme, a Government-backed certification scheme that helps keep your organisation’s - and your customers’ - data safe from cyber attacks.