Article written on 26 October 2010 During the European Security
and Information System congress, the CNIL released a guide
regarding the security of personal data. This guide aims at
helping security managers to respect the law « Data Processing,
Data Files and Individual Liberties » and to ensure the security
of personal data. The present article is a summary of the
recommendations of this guide. Context and presentation There
are more and more personal data manipulated, and threats
affecting information systems are in parallel increasing (see on
this topic Cert-IST 2009 annual report on the vulnerabilities
and attacks). During all their lifecycle, personal data must
therefore be protected against the loss of confidentiality, the
loss of integrity, the usurpation or the simple loss.
Organisation of the guide The CNIL guide is made of 17
datasheets allowing security managers to evaluate the level of
security of personal data in their organisation. These sheets
are divided into three sections mentioning the el