Storage and Security Storage Risks of on premises storage Some examples of common risks relating to the storage of data containing personal information include: • Theft or vandalism: Physical servers or storage devices could be stolen, damaged, or destroyed, leading to potential loss of data. • Unauthorised access: Without robust security controls, unauthorised individuals (e.g., employees, volunteers, visitors) may gain access to data storage areas, leading to potential data breaches. • Insufficient monitoring: On-premises systems may lack the continuous monitoring and automated alerting that cloud-based systems often provide, making it harder to detect and respond to breaches in real-time. • Weak access controls: If staff access controls (such as passwords, authentication, and rolebased access) are not properly enforced, there is a risk of unauthorised access to sensitive data. • Human error: Data stored on-premises is vulnerable to human error, such as accidental deletion or misconfiguration, leading to potential loss of information. Manual or infrequent backups can result in data loss during a breach. Risks of cloud or remote storage Some examples of common risks relating to personal information held in the cloud include: • Lack of full control over data: Although the large reputable cloud providers are very safe, when using cloud services, NHRIs are in principle dependent on the security measures, policies, and infrastructure of the cloud provider. Any vulnerabilities or failures on the provider’s end could result in a data breach. It can also be challenging to ensure that data is completely deleted from a cloud provider’s servers, especially if the provider uses multiple storage locations. • Vendor lock-in - dependence on a single provider could make it difficult to switch providers or migrate data if the need arises. This can also limit flexibility in negotiating pricing or service changes. • Misconfiguration risks: Improperly configured cloud services are the leading cause of cloudrelated breaches. This is where staff have not understood how to properly use security settings, have left open storage buckets or not corrected weak access controls. This is part of the challenge of managing your data when it is stored with a cloud provider. Without skilled IT staff, NHRIs may struggle to manage these services effectively. Data Protection Guidelines for NHRIs Toolkit 18