What should you assess before using AI tools with personal data?
Before personal data goes into an AI tool, you need a decided purpose and legal basis, a review of the supplier’s terms and an assessment of whether a DPIA is required.
Category Insights
Knowledge, guidance and practical insights from Kristensson i Skåne AB.
Business continuity management in practice – from impact analysis to an exercised plan
Continuity starts in the business, not in IT. How to move from impact analysis and critical activities to MTPD, RTO, dependencies, workarounds, a continuity plan and exercises.
DORA incident reporting in practice – the ESAs’ operational instructions and the new Fidac version
The ESAs have published operational instructions for DORA incident reporting and the Swedish FSA launches a new Fidac version on 19 October. What is expected, where reporting fails and how to build a process that holds under time pressure.
Tamper-proof logs – what does it take for a log to hold up in an audit?
A log the administrator can edit is not tamper-proof. Three levels of log protection, what ISO 27001 actually requires, and four steps that show where your logs stand.
Is SFTP end-to-end encrypted? No – and usually that is enough
SFTP and FTPS protect the file in transit, but the transfer server can read the content. What the difference from end-to-end encryption means in a supplier review – and how the requirement should be worded.
SFTP, FTPS or MFT – how do you choose the right secure file transfer solution?
SFTP is built on SSH, FTPS secures FTP with TLS and MFT is a platform. How to choose based on the number of flows, automation, traceability, partner requirements and availability.
Why IT and security projects stall – five problems that are rarely technical
Mandate, target state, business resources, dependencies and handover into operations. Five reasons IT, security and regulatory projects grind to a halt.
When does an organisation need a data protection officer? How to make a documented DPO assessment
Must you designate a data protection officer? The Article 37 obligation depends on what you do with personal data, not on company size. How to assess core activities, monitoring, special categories and scale, and document the answer.
Interim IT manager or IT consultant – which support does the business actually need?
Sometimes the problem is not a lack of technical expertise but a lack of IT leadership. On mandate, supplier management, IT strategy, scope and handover.
Microsoft 365 backup – what Microsoft protects and what you need to own yourself
Microsoft 365 has built-in recovery, but it does not replace a considered backup strategy. On Exchange, OneDrive, SharePoint, Entra, RPO and RTO, and how recovery should be tested.