Chapter 8
Cybersecurity and information protection
Security, minimization and incident response in systems processing personal data.
8.1 Data and purposes
Personnel files may contain identifying, financial and particularly sensitive information. The data needed for each process must be identified, avoiding collection merely because information is available. Minimization reduces both the risks of misuse and protection costs.
The legal basis, information provided to people and retention periods must be analyzed according to the purpose. In employment, the imbalance between the parties may affect the validity of consent. A generic checkbox must not substitute for that analysis [R2].
8.2 Access and separation of duties
Access control must apply the principle of least privilege. Multifactor authentication adds protection but does not remove the need to review permissions, devices and procedures. A correctly authenticated account can be misused or have excessive authorizations.
Significant operations require traceability and review. Incompatible tasks, such as modifying data and approving its financial effect, should be separated where possible. Periodic reviews help detect inherited permissions that no longer serve a legitimate function.
8.3 AI-specific threats
An assistant may disclose information if it combines sources without respecting permissions. It may also follow malicious instructions embedded in a document or generate a response that appears official without being so. Controls must apply to data access and available actions, not only visible text.
Tests must include manipulated documents, extraction queries and out-of-scope requests. Confidential information must not be sent to external services without appropriate safeguards and authorization. Usage logs also need limits to avoid retaining unnecessary data.
8.4 Incidents and continuity
Incident response requires designated responsibilities, reporting channels and rehearsed procedures. Priorities should be containing the problem, preserving evidence and assessing consequences. Communication or notification obligations are analyzed according to the incident and applicable law.
Backups must be tested through restoration. An unverified backup offers only apparent security. Continuity also requires alternative working arrangements when a platform is unavailable, especially in processes affecting pay or rights.
8.5 Retention and review
Retention periods must reflect identified purposes and obligations. Indefinite storage can increase exposure without adding value. Deletion must address active systems, exports and the backup life cycle.
Data protection is an ongoing practice. Changes in use, vendors or integrations require controls to be reviewed. Where appropriate, an impact assessment allows risks to be studied before processing and measures, limits and pending decisions to be documented [R2].
Questionnaires
Chapter knowledge & Human Resources dilemmas
Dilemmas receive no moral or employability score and are not used to assess job candidates.