GDPR compliance for smartphones and tablets

On May 25, 2018, the EU General Data Protection Regulation (GDPR) in force. What is often overlooked in the process: The use of mobile devices is also affected by the GDPR.

Since personal data is now increasingly processed or stored on smartphones and tablets, this data must of course also be protected there accordingly. According to the GDPR, companies must also prove that they have implemented protection mechanisms to protect personal data on their mobile devices. Among other things, the GDPR requires:

• Protecting the integrity and confidentiality of corporate data on mobile devices, whether owned by the company or by the respective user (BYOD);
• Appropriate precautions to protect data through encryption; whereby data must be encrypted not only on the mobile device itself, but also during transmission;
• Detailed documentation of the respective protection mechanisms; such documentation must also be able to be presented at any time, independently of specific cases of damage.

According to Article 25, data protection must be ensured through the right technology and through data protection-friendly default settings. To this end, appropriate technical and organizational measures (TOMs) must be taken.

Compliance through container technology

Companies can only meet these requirements for mobile systems through container-based separation of business and private data and applications. This is the only way to reliably protect business data from external threats and unauthorized use. If the business data and applications are in an encrypted container and communication from the mobile end device to the corporate IT is also seamlessly encrypted, the relevant requirements are met.

With a container technology, all requirements of the DSGVO are met and smartphones and tablets are protected by the strict separation of private and business data.

Author: Günter Junk, CEO of the Virtual Solution AG