Protecting Personal Data When Working Remotely

Remote work increases the risk of personal data and confidential information leaks. As the data controller, you are responsible for implementing technical and organizational measures that match the risks. This guide outlines the legal requirements, common risks and baseline safeguards to consider before an incident occurs.

Why remote work carries more risk than working on site

In an office, you control the data-processing environment: the network, equipment, physical access to documents and proximity to the IT team. With remote work, you lose most of these advantages.

Differences in risk include:

• Network: in the office, employees connect to a secured company network. Remotely, they often use home or public Wi-Fi.
• Equipment: in the office, a laptop stays in the building. With remote work, it is transported, increasing the risk of theft or damage.
• IT support: in the office, the response is immediate. Remotely, it may be delayed or limited.
• Third-party access: the office has access controls. At home or in a café, someone may see the screen or login details.

The takeaway: if you introduce or maintain remote work, analyze and secure that process separately.

Legal requirements: what you must do

GDPR, Article 24(1)

The GDPR requires you to implement appropriate technical and organizational measures, taking into account the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of natural persons.

In practice, this means:

• Assess the risks before introducing remote work. Estimate what data will be processed outside the office and what risks this creates.
• Choose safeguards proportionate to risk. The GDPR does not provide a ready-made list of measures. You are responsible for ensuring that your solutions are proportionate to the identified risks.
• Monitor and update. Safeguards need regular reviews. What was sufficient a year ago may no longer meet the standard today.

Labor Code, Article 67²⁶ (in force since 7 April 2023)

This provision imposes two duties on you:

1. Set personal-data protection procedures for remote work and provide instructions and training.
2. Obtain written confirmation from the employee that they have read the procedures and undertake to follow them.

If you do not do this, you lack a formal basis for enforcing security rules with the employee.

How to secure remote work, step by step

Treat introducing remote work as a project. Start with an assessment, then choose measures.

Step 1: Analyze the data

• Identify the categories of personal data you process, such as employee data, customer data and sensitive data.
• Check the legal basis on which you process it.
• Determine which employees will have access to which data. The risk for a remote payroll employee differs from the risk for an administrative employee.

Step 2: Choose safeguards

There are two categories of measures:

• Technical measures: physical, technological and IT solutions, including encryption, VPNs, firewalls, equipment configuration and network security.
• Organizational measures: procedures, policies, instructions, guidelines and training used in the organization.

You can choose the specific solutions, but you remain responsible for ensuring they are proportionate to the assessed risk. Follow recommendations and guidance from both EU and national sources; they can provide useful direction.

Step 3: Eliminate paper documents

Design remote work so employees do not need paper documents. Current technology makes it possible to digitize most duties fully.

If paper documents are necessary:

• The employee must return them to the office after work.
• If they are no longer needed, the employee must destroy them securely.
• Provide destruction tools, such as shredders or other solutions. This is your cost and responsibility.

Main risks associated with remote work

There are three main risks to consider:

1. Loss of or damage to equipment: remote employees transport laptops and phones much more often than office-based employees.
2. Data interception over unsecured Wi-Fi: hackers monitor network traffic, a technique known as sniffing, through poorly secured hotspots and can gain access to data.
3. Someone viewing a screen or login details: in public places, someone may see what an employee is working on or read a password for work email.

Personal devices for work (BYOD)

BYOD (Bring Your Own Device) is a model in which an employee or contractor uses a personal laptop, smartphone or tablet for work.

The issue is that, unlike company-owned equipment, the employee is mainly responsible for securing and controlling the device in a BYOD model. You therefore need clear guidelines and eligibility criteria. Otherwise, you risk a personal data breach or disclosure of trade secrets.

Minimum requirements for BYOD devices

• An operating system supported by its manufacturer: for example, using Windows 8.1 is unacceptable because support ended on 10 January 2023.
• Current software, especially the operating system and antivirus software. Updates contain security patches that fix vulnerabilities that could allow unauthorized access.
• An active firewall, such as Microsoft Defender, and configured antivirus software with up-to-date databases.
• A strong, unique access password: sufficient length, upper- and lowercase letters, numbers and special characters. The password should be known only to the user and used in one place only. Introduce a password manager that generates and stores strong passwords and automatically fills in login fields. The employee remembers only one master password.
• Limited permissions on the work account: the account used for daily work should not have administrator privileges. Only the employee should have administrator access to manage their own device.
• Regular backups, especially if the employee cannot access the organization’s network resources.
• A privacy screen filter that limits display visibility to a person sitting directly in front of the device.
• Disk encryption that requires an additional password to decrypt. Even if the device is stolen and its system-account password is discovered, the disk will in most cases remain unusable to the thief.
• An automatic screen lock that activates after inactivity, for example after 3 minutes.
• Access to work systems only through a VPN (Virtual Private Network). A VPN creates an encrypted data tunnel, hides the IP address and allows safer use of Wi-Fi.

Consult your BYOD and remote-work procedures with a lawyer or data protection officer and an IT specialist. This helps you check whether the safeguards match the actual risks.

Consequences of inadequate safeguards

Failing to implement appropriate technical and organizational measures exposes your organization to real financial, reputational and operational losses.

What you risk

• A breach of confidentiality, integrity or availability: a leak, change or loss of personal data processed by the organization.
• An administrative fine from the President of UODO: up to EUR 20,000,000 or up to 4% of total worldwide annual turnover, whichever amount is higher.
• Liability toward data subjects: compensation claims and loss of trust.

A real-world example

The President of UODO imposed a fine of PLN 1.6 million on Virgin Mobile Polska, whose legal successor is P4 Sp. z o.o., for failing to implement appropriate technical and organizational measures to secure data processing in IT systems.

Summary: what to implement and in what order

1. Assess the risks of remote work, taking into account data categories, employee roles and the work environment.
2. Choose technical safeguards: encryption, VPN, firewalls, current software and a password manager.
3. Prepare organizational measures: data protection procedures for remote work, a BYOD policy and instructions for handling paper documents.
4. Train employees and obtain written confirmation that they have read the procedures, as required by Article 67²⁶ of the Labor Code.
5. Monitor and update by regularly reviewing whether the safeguards remain adequate.

Statistics underscore the importance of training: nearly 95% of incidents are unintentional, and personnel at data controllers caused 86% of the breaches examined.

Sources:

1. NordVPN: What is a sniffer?
2. Security guide for telework, remote work and use of personal devices (BYOD)
3. UODO decision concerning Virgin Mobile Polska
4. 2022 incident report: ZFODO

Frequently asked questions

What data protection duties does an employer have for remote work? Article 24(1) of the GDPR requires you to assess risks, choose technical and organizational measures that match those risks, and monitor and update them regularly. Article 67²⁶ of the Labor Code, in force since 7 April 2023, adds two duties: set data protection procedures for remote work and provide instructions and training, then obtain written confirmation from the employee that they have read the procedures. Without that confirmation, you lack a formal basis for enforcing security rules with the employee.

What are the main personal data risks of remote work? The three main risks are loss of or damage to equipment, because remote employees transport laptops and phones more often than office-based employees; data interception over unsecured Wi-Fi, when hackers monitor network traffic through poorly secured hotspots using a technique called sniffing; and someone viewing a screen or login details in a public place. Limited IT support and lack of physical access controls, which naturally protect an office, add to these risks.

How can a company secure remote work under the GDPR, step by step? Start by analyzing the data: identify the personal data categories you process, the legal basis and which employees will access it remotely. Then choose technical measures, such as disk encryption, VPNs, firewalls, current software and a password manager, and organizational measures, such as remote-work data procedures, a BYOD policy and instructions for paper documents. Finally, train employees, obtain written confirmation that they have read the procedures and regularly review whether the safeguards remain adequate. What was sufficient a year ago may no longer meet the standard today.

Can an employee’s personal laptop be used to work with personal data, and what conditions apply? It can, but you need clear guidelines and minimum technical requirements because the employee is mainly responsible for securing a BYOD device. Requirements include a manufacturer-supported operating system, current software and antivirus, an active firewall, a strong unique password managed with a password manager, a work account without administrator privileges, regular backups, a privacy screen, disk encryption, an automatic screen lock and access to work systems only through a VPN. Consult the BYOD procedure with a lawyer or data protection officer and an IT specialist.

What can happen if a company fails to secure data during remote work? You risk a breach of the confidentiality, integrity or availability of personal data, an administrative fine from the President of UODO of up to EUR 20,000,000 or 4% of total worldwide annual turnover, whichever is higher, and compensation claims from data subjects. A practical example is the PLN 1.6 million fine imposed by the President of UODO on Virgin Mobile Polska for failing to implement appropriate technical and organizational safeguards for data processing in IT systems.