際際滷

際際滷Share a Scribd company logo
息 Computer-Zauber
The year after 25.05.2018
or my GDPR journey for developers
息 Computer-Zauber
Karen
Falkenberg
 2006 start working
with TYPO3
 2010 start working as
Data Protection Officer
 Hobbies: family, our
dog Fips, gardening
and travelling
息 Computer-Zauber
GDPR Journey
1. Stop
GDPR overview and what happens in
Germany/Europe?
2. Stop
Developers and the GDPR
Developers responsibilities and practice Advice
3. Stop
Data Breach
息 Computer-Zauber
1. Stop
GDPR overview and what happens in
Germany/Europe?
息 Computer-Zauber
GDPR overview
 AdobeStock 息 SBphotos #187672733
息 Computer-Zauber
GDPR overview
 AdobeStock 息 SBphotos #187672733
息 Computer-Zauber
GDPR overview
 AdobeStock 息 SBphotos #187672733
息 Computer-Zauber
GDPR overview
 AdobeStock 息 SBphotos #187672733
息 Computer-Zauber
GDPR overview
 AdobeStock 息 SBphotos #187672733
息 Computer-Zauber
GDPR overview
 AdobeStock 息 SBphotos #187672733
息 Computer-Zauber
Compliant?
息 Computer-Zauber
What happens in Germany?
 The federal states proceed differently
 Sending Questionnaires  for making
pre-selections for more detailed
examinations
 Extreme questionnaires in Bavaria,
Thuringia, Saxony
息 Computer-Zauber
What happens in Germany?
 Focus of privacy reviews by the data
protection authorities:
 Delete data in Enterprise-Resource-
Planning systems,
 Violations of data protection by
(sub)processors of contracts
 Control- Implementation of the GDPR in
small and medium-sized enterprises
息 Computer-Zauber
What happens in Germany?
 Privacy reviews:
 Control patching concept of websites
 Control 2FA for webapplication
 Control of measures in case of
infestation of Ransom Software
息 Computer-Zauber
What happens in Europe?
 The first interpretations correspond to the
German approaches
 Spain - Punish that too many people have
access to data in the hospital.
息 Computer-Zauber
What happens in Europe?
 Austria takes the chance of an opening clause 
easer to operate a website
 But an austrian court decides to replace names on
bell plate with the apartment number
息 Computer-Zauber
2. Stop
Developers and the GDPR
Developers responsibilities and practice Advice
息 Computer-Zauber
A website developer just wants
to code.
No more and no less.
息 Computer-Zauber
They cant give legal advice.
息 Computer-Zauber
But the three monkey principle:
see nothing, hear nothing, say
nothing - does not count.
息 Computer-Zauber
Its your daily work!
息 Computer-Zauber
Website - the privacy policy
息 Computer-Zauber
Technical and organizational
measures (TOM)
息 Computer-Zauber
Access Control
 manage user profiles
 use of secure
passwords
 Every developer or
editor has his own
backend account
 Login
username/password
 Intrusion Detection
System
 Logging of accesses
息 Computer-Zauber
Availability
 regular backups
 recovery concept
 system checks
 server maintenance
 Uninterruptible Power
Supply
 fire and smoke detectors
 RAID system
息 Computer-Zauber
Integrity/Transfer Control
 Provision of encrypted
connections https
 E-mail encryption
 use of signature
procedures
 protocolling of
transmissions
 Deletion regulations
 traceability of input,
modification and deletion of
data
息 Computer-Zauber
Protection of personal data
(FE)
 Google Font  local
integration
 Jquery  local
integration
 Maps  if possible
using openstreetmap
 Video from YouTube
(Privacy-friendly
integration)
息 Computer-Zauber
Protection of personal data
(FE)
 Information Art. 13
GDPR for contact forms
 Frontend Login
 2FA
 Security password
check
 Using SSL
 EuGH judgement -
useful to have a social
media privacy statement
息 Computer-Zauber
Protection of personal data
(FE)
 Cookie hint for First
Party Cookies
Matomo on your own
server
 Cookie verifiable
consent for second and
third party cookies
 Solution could be
Usercentrics
息 Computer-Zauber
Third Party Cookies
verifiable consent
息 Computer-Zauber
Protection of personal data
(BE)
 Password Hashing
 2FA
 User rights!
息 Computer-Zauber
When using providers the
responsibility is on the provider
as well as on you.
(hosting, newsletter, payment,..)
息 Computer-Zauber
Play-off
for developer
息 Computer-Zauber
Website is save 1:0
息 Computer-Zauber
Security Header 2:0
 Controlling:
 https://webbkoll.dataskydd.net/de/
 https://securityheaders.com/
息 Computer-Zauber
Code Examples Security Controlling:
 https://www.owasp.org/index.php/OWASP_Secure_Head
ers_Project#tab=Headers
 https://scotthelme.co.uk/hardening-your-http-response-
headers/
Practice Advice Security Header
息 Computer-Zauber
Practice Advice Security Header
Implementation in TYPO3:
 https://jweiland.net/typo3/codebeispiele/allgemeines/secu
rity-headers-mit-typo3.html#c5803
息 Computer-Zauber
Example TYPO3 Version 7 (und h旦her):
config.additionalHeaders {
10.header = strict-transport-security:max-age=31536000
20.header = X-Frame-Options:SAMEORIGIN
30.header = X-Xss-Protection: 1; mode=block
40.header = X-Content-Type-Options: nosniff
50.header = Referrer-Policy:strict-origin
}
Practice Advice Security Header
息 Computer-Zauber
Further solution via htaccess
Header set 
Content-Security-Policy 
default-src unsafe-inline none www.computerzauber.de;
script-src unsafe-inline none www.computerzauber.de;
frame-ancestors www.computerzauber.de;
base-uri self;
form-action self;

Header set 
X-Frame-Options: SAMEORIGIN
Header set 
X-Xss-Protection: 1; mode=block
Header set 
X-Content-Type-Options: nosniff
Header set 
Referrer-Policy: no-referrer
Header set 
Feature-Policy: sync-xhr self https:// www.computerzauber.de
Practice Advice Security Header
息 Computer-Zauber
Improvement of the website
security 3:0
息 Computer-Zauber
Using 
SIWECOS Quick
Check
Implementation
the daily
SIWECOS
Check
https://siwecos.de
/
Improvement of the website
security
息 Computer-Zauber
3. Stop
Data Breach
息 Computer-Zauber
Data Breach
Need a process for dealing
with Data Breach
(contingency plan)
息 Computer-Zauber
Data Breach
 This Data Breaches must be reported to
supervisory authority:
 Violations of the protection of personal
data include
 hacking
 data theft
 loss unencrypted USB or notebook
with unencrypted hard disk
 server room break-in
 Data access through cyber attack
 https://datenschutz-hamburg.de/assets/pdf/2018.11.15_Data%20Breach_Vermerk_extern.pdf
息 Computer-Zauber
 For repeated action - notification of
supervisory authority necessary
 Wrong invoice or prescription issued
 Open mail distributors
 
Data Breach
 https://datenschutz-hamburg.de/assets/pdf/2018.11.15_Data%20Breach_Vermerk_extern.pdf
息 Computer-Zauber
 not required to report but to document:
 power outage
 computer crash
 
Data Breach
 https://datenschutz-hamburg.de/assets/pdf/2018.11.15_Data%20Breach_Vermerk_extern.pdf
息 Computer-Zauber
The end of the journey!
息 Computer-Zauber
You can contact me:
kf@computer-zauber.de
Twitter: computerzauber
Slack: computerzauber
Photos: 息SBphotos
#187672733
@computerzauber
@pixabay.com
Pixabay License
Free for commercial use
No attribution required
Questions?
Ad

Recommended

Fix: Netgear Extender Firmware Update Failure
Fix: Netgear Extender Firmware Update Failure
makeyourownbuzz
Webinar: SOC Ekipleri i巽in MITRE ATT&CK Kullan脹m Senaryolar脹
Webinar: SOC Ekipleri i巽in MITRE ATT&CK Kullan脹m Senaryolar脹
BGA Cyber Security
Quick Installation Guide EWS300AP English
Quick Installation Guide EWS300AP English
EnGenius Europe
Closing the Loop on Web Application Vulnerabilities - John Dilley, Akamai
Closing the Loop on Web Application Vulnerabilities - John Dilley, Akamai
Akamai Technologies
Datasheet EWS300AP
Datasheet EWS300AP
EnGenius Europe
Datasheet EnGenius EUB1200AC
Datasheet EnGenius EUB1200AC
EnGenius Europe
Video surveillance: Why should my business use it?
Video surveillance: Why should my business use it?
SwiftTech Solutions, Inc.
2019-CertiFUNcation-GDPR_12072019-typo3
2019-CertiFUNcation-GDPR_12072019-typo3
TYPO3 CertiFUNcation
GDPR for developers
GDPR for developers
Bozhidar Bozhanov
GDPR - General Data Protection Regulation
GDPR - General Data Protection Regulation
Zero Point Development
WordPress and the GDPR
WordPress and the GDPR
Arjan Olsder
General Data Protection Regulation, a developer's story
General Data Protection Regulation, a developer's story
Michelangelo van Dam
WP Helsinki Meetup - GDPR for devs
WP Helsinki Meetup - GDPR for devs
Tiia Rantanen
QA Fest 2017. Per Thorsheim.GDPR - An overview and its relevance for QA
QA Fest 2017. Per Thorsheim.GDPR - An overview and its relevance for QA
QAFest
GDPR- The Buck Stops Here
GDPR- The Buck Stops Here
Kellyn Pot'Vin-Gorman
GDPR, User Data, Privacy, and Your Apps
GDPR, User Data, Privacy, and Your Apps
Carl Brown
GDPR - Applift firstscreen june 2016
GDPR - Applift firstscreen june 2016
Saira Nayak, JD, CIPP/US/E
Magento checklist AVG / GDPR - Algemene Verordering Gegevensbescherming
Magento checklist AVG / GDPR - Algemene Verordering Gegevensbescherming
Erwin Otten
Developer view on new EU privacy legislation (GDPR)
Developer view on new EU privacy legislation (GDPR)
Exove
TBEX 2018 - Digital Security and GDPR Considerations for the Travel and Hospi...
TBEX 2018 - Digital Security and GDPR Considerations for the Travel and Hospi...
Omo Osagiede
Digital Security and Data Protection Considerations for Hospitality Brands an...
Digital Security and Data Protection Considerations for Hospitality Brands an...
TBEX
Avoiding the 7 Deadly Sins of GDPR Non-Compliance - Pubcon 2018
Avoiding the 7 Deadly Sins of GDPR Non-Compliance - Pubcon 2018
Search Commander, Inc.
Gdpr workshop module_1
Gdpr workshop module_1
S Sid Ahmed
GDPR for WP Status
GDPR for WP Status
K奪re Mulvad Steffensen
Flight East 2018 PresentationData Breaches and the Law
Flight East 2018 PresentationData Breaches and the Law
Synopsys Software Integrity Group
GDPR for Things - ThingsCon Amsterdam 2017
GDPR for Things - ThingsCon Amsterdam 2017
Saskia Videler
GDPR Guide: The ICO's 12 Recommended Steps To Take Now
GDPR Guide: The ICO's 12 Recommended Steps To Take Now
HackerOne
apidays LIVE Paris 2021 - The GDPR Developer Guide by Jerome Gorin, CNIL
apidays LIVE Paris 2021 - The GDPR Developer Guide by Jerome Gorin, CNIL
apidays
Complete Guideliness to Build an Effective Maintenance Plan.ppt
Complete Guideliness to Build an Effective Maintenance Plan.ppt
QualityzeInc1
Test Case Design Techniques Practical Examples & Best Practices in Software...
Test Case Design Techniques Practical Examples & Best Practices in Software...
Muhammad Fahad Bashir

More Related Content

Similar to GDPR Session - TYPO3 - t3dd (20)

GDPR for developers
GDPR for developers
Bozhidar Bozhanov
GDPR - General Data Protection Regulation
GDPR - General Data Protection Regulation
Zero Point Development
WordPress and the GDPR
WordPress and the GDPR
Arjan Olsder
General Data Protection Regulation, a developer's story
General Data Protection Regulation, a developer's story
Michelangelo van Dam
WP Helsinki Meetup - GDPR for devs
WP Helsinki Meetup - GDPR for devs
Tiia Rantanen
QA Fest 2017. Per Thorsheim.GDPR - An overview and its relevance for QA
QA Fest 2017. Per Thorsheim.GDPR - An overview and its relevance for QA
QAFest
GDPR- The Buck Stops Here
GDPR- The Buck Stops Here
Kellyn Pot'Vin-Gorman
GDPR, User Data, Privacy, and Your Apps
GDPR, User Data, Privacy, and Your Apps
Carl Brown
GDPR - Applift firstscreen june 2016
GDPR - Applift firstscreen june 2016
Saira Nayak, JD, CIPP/US/E
Magento checklist AVG / GDPR - Algemene Verordering Gegevensbescherming
Magento checklist AVG / GDPR - Algemene Verordering Gegevensbescherming
Erwin Otten
Developer view on new EU privacy legislation (GDPR)
Developer view on new EU privacy legislation (GDPR)
Exove
TBEX 2018 - Digital Security and GDPR Considerations for the Travel and Hospi...
TBEX 2018 - Digital Security and GDPR Considerations for the Travel and Hospi...
Omo Osagiede
Digital Security and Data Protection Considerations for Hospitality Brands an...
Digital Security and Data Protection Considerations for Hospitality Brands an...
TBEX
Avoiding the 7 Deadly Sins of GDPR Non-Compliance - Pubcon 2018
Avoiding the 7 Deadly Sins of GDPR Non-Compliance - Pubcon 2018
Search Commander, Inc.
Gdpr workshop module_1
Gdpr workshop module_1
S Sid Ahmed
GDPR for WP Status
GDPR for WP Status
K奪re Mulvad Steffensen
Flight East 2018 PresentationData Breaches and the Law
Flight East 2018 PresentationData Breaches and the Law
Synopsys Software Integrity Group
GDPR for Things - ThingsCon Amsterdam 2017
GDPR for Things - ThingsCon Amsterdam 2017
Saskia Videler
GDPR Guide: The ICO's 12 Recommended Steps To Take Now
GDPR Guide: The ICO's 12 Recommended Steps To Take Now
HackerOne
apidays LIVE Paris 2021 - The GDPR Developer Guide by Jerome Gorin, CNIL
apidays LIVE Paris 2021 - The GDPR Developer Guide by Jerome Gorin, CNIL
apidays
GDPR - General Data Protection Regulation
GDPR - General Data Protection Regulation
Zero Point Development
WordPress and the GDPR
WordPress and the GDPR
Arjan Olsder
General Data Protection Regulation, a developer's story
General Data Protection Regulation, a developer's story
Michelangelo van Dam
WP Helsinki Meetup - GDPR for devs
WP Helsinki Meetup - GDPR for devs
Tiia Rantanen
QA Fest 2017. Per Thorsheim.GDPR - An overview and its relevance for QA
QA Fest 2017. Per Thorsheim.GDPR - An overview and its relevance for QA
QAFest
GDPR, User Data, Privacy, and Your Apps
GDPR, User Data, Privacy, and Your Apps
Carl Brown
Magento checklist AVG / GDPR - Algemene Verordering Gegevensbescherming
Magento checklist AVG / GDPR - Algemene Verordering Gegevensbescherming
Erwin Otten
Developer view on new EU privacy legislation (GDPR)
Developer view on new EU privacy legislation (GDPR)
Exove
TBEX 2018 - Digital Security and GDPR Considerations for the Travel and Hospi...
TBEX 2018 - Digital Security and GDPR Considerations for the Travel and Hospi...
Omo Osagiede
Digital Security and Data Protection Considerations for Hospitality Brands an...
Digital Security and Data Protection Considerations for Hospitality Brands an...
TBEX
Avoiding the 7 Deadly Sins of GDPR Non-Compliance - Pubcon 2018
Avoiding the 7 Deadly Sins of GDPR Non-Compliance - Pubcon 2018
Search Commander, Inc.
Gdpr workshop module_1
Gdpr workshop module_1
S Sid Ahmed
GDPR for Things - ThingsCon Amsterdam 2017
GDPR for Things - ThingsCon Amsterdam 2017
Saskia Videler
GDPR Guide: The ICO's 12 Recommended Steps To Take Now
GDPR Guide: The ICO's 12 Recommended Steps To Take Now
HackerOne
apidays LIVE Paris 2021 - The GDPR Developer Guide by Jerome Gorin, CNIL
apidays LIVE Paris 2021 - The GDPR Developer Guide by Jerome Gorin, CNIL
apidays

Recently uploaded (20)

Complete Guideliness to Build an Effective Maintenance Plan.ppt
Complete Guideliness to Build an Effective Maintenance Plan.ppt
QualityzeInc1
Test Case Design Techniques Practical Examples & Best Practices in Software...
Test Case Design Techniques Practical Examples & Best Practices in Software...
Muhammad Fahad Bashir
On-Device AI: Is It Time to Go All-In, or Do We Still Need the Cloud?
On-Device AI: Is It Time to Go All-In, or Do We Still Need the Cloud?
Hassan Abid
IObit Driver Booster Pro 12 Crack Latest Version Download
IObit Driver Booster Pro 12 Crack Latest Version Download
pcprocore
Streamlining CI/CD with FME Flow: A Practical Guide
Streamlining CI/CD with FME Flow: A Practical Guide
Safe Software
From Data Preparation to Inference: How Alluxio Speeds Up AI
From Data Preparation to Inference: How Alluxio Speeds Up AI
Alluxio, Inc.
Threat Modeling a Batch Job Framework - Teri Radichel - AWS re:Inforce 2025
Threat Modeling a Batch Job Framework - Teri Radichel - AWS re:Inforce 2025
2nd Sight Lab
Best AI-Powered Wearable Tech for Remote Health Monitoring in 2025
Best AI-Powered Wearable Tech for Remote Health Monitoring in 2025
SEOLIFT - SEO Company London
Why Every Growing Business Needs a Staff Augmentation Company IN USA.pdf
Why Every Growing Business Needs a Staff Augmentation Company IN USA.pdf
mary rojas
Complete WordPress Programming Guidance Book
Complete WordPress Programming Guidance Book
Shabista Imam
Which Hiring Management Tools Offer the Best ROI?
Which Hiring Management Tools Offer the Best ROI?
HireME
Y - Recursion The Hard Way GopherCon EU 2025
Y - Recursion The Hard Way GopherCon EU 2025
Eleanor McHugh
Sysinfo OST to PST Converter Infographic
Sysinfo OST to PST Converter Infographic
SysInfo Tools
Foundations of Marketo Engage - Programs, Campaigns & Beyond - June 2025
Foundations of Marketo Engage - Programs, Campaigns & Beyond - June 2025
BradBedford3
Best Software Development at Best Prices
Best Software Development at Best Prices
softechies7
Introduction to Agile Frameworks for Product Managers.pdf
Introduction to Agile Frameworks for Product Managers.pdf
Ali Vahed
Simplify Insurance Regulations with Compliance Management Software
Simplify Insurance Regulations with Compliance Management Software
Insurance Tech Services
A Guide to Telemedicine Software Development.pdf
A Guide to Telemedicine Software Development.pdf
Olivero Bozzelli
IDM Crack with Internet Download Manager 6.42 Build 41 [Latest 2025]
IDM Crack with Internet Download Manager 6.42 Build 41 [Latest 2025]
pcprocore
Best Practice for LLM Serving in the Cloud
Best Practice for LLM Serving in the Cloud
Alluxio, Inc.
Complete Guideliness to Build an Effective Maintenance Plan.ppt
Complete Guideliness to Build an Effective Maintenance Plan.ppt
QualityzeInc1
Test Case Design Techniques Practical Examples & Best Practices in Software...
Test Case Design Techniques Practical Examples & Best Practices in Software...
Muhammad Fahad Bashir
On-Device AI: Is It Time to Go All-In, or Do We Still Need the Cloud?
On-Device AI: Is It Time to Go All-In, or Do We Still Need the Cloud?
Hassan Abid
IObit Driver Booster Pro 12 Crack Latest Version Download
IObit Driver Booster Pro 12 Crack Latest Version Download
pcprocore
Streamlining CI/CD with FME Flow: A Practical Guide
Streamlining CI/CD with FME Flow: A Practical Guide
Safe Software
From Data Preparation to Inference: How Alluxio Speeds Up AI
From Data Preparation to Inference: How Alluxio Speeds Up AI
Alluxio, Inc.
Threat Modeling a Batch Job Framework - Teri Radichel - AWS re:Inforce 2025
Threat Modeling a Batch Job Framework - Teri Radichel - AWS re:Inforce 2025
2nd Sight Lab
Best AI-Powered Wearable Tech for Remote Health Monitoring in 2025
Best AI-Powered Wearable Tech for Remote Health Monitoring in 2025
SEOLIFT - SEO Company London
Why Every Growing Business Needs a Staff Augmentation Company IN USA.pdf
Why Every Growing Business Needs a Staff Augmentation Company IN USA.pdf
mary rojas
Complete WordPress Programming Guidance Book
Complete WordPress Programming Guidance Book
Shabista Imam
Which Hiring Management Tools Offer the Best ROI?
Which Hiring Management Tools Offer the Best ROI?
HireME
Y - Recursion The Hard Way GopherCon EU 2025
Y - Recursion The Hard Way GopherCon EU 2025
Eleanor McHugh
Sysinfo OST to PST Converter Infographic
Sysinfo OST to PST Converter Infographic
SysInfo Tools
Foundations of Marketo Engage - Programs, Campaigns & Beyond - June 2025
Foundations of Marketo Engage - Programs, Campaigns & Beyond - June 2025
BradBedford3
Best Software Development at Best Prices
Best Software Development at Best Prices
softechies7
Introduction to Agile Frameworks for Product Managers.pdf
Introduction to Agile Frameworks for Product Managers.pdf
Ali Vahed
Simplify Insurance Regulations with Compliance Management Software
Simplify Insurance Regulations with Compliance Management Software
Insurance Tech Services
A Guide to Telemedicine Software Development.pdf
A Guide to Telemedicine Software Development.pdf
Olivero Bozzelli
IDM Crack with Internet Download Manager 6.42 Build 41 [Latest 2025]
IDM Crack with Internet Download Manager 6.42 Build 41 [Latest 2025]
pcprocore
Best Practice for LLM Serving in the Cloud
Best Practice for LLM Serving in the Cloud
Alluxio, Inc.
Ad

GDPR Session - TYPO3 - t3dd