{"id":9641,"date":"2025-03-24T13:08:42","date_gmt":"2025-03-24T12:08:42","guid":{"rendered":"https:\/\/www.gpsj.co.uk\/?p=9641"},"modified":"2025-03-24T13:09:36","modified_gmt":"2025-03-24T12:09:36","slug":"why-best-practice-is-failing-to-protect-personal-data-a-call-for-data-centric-security","status":"publish","type":"post","link":"https:\/\/www.gpsj.co.uk\/?p=9641","title":{"rendered":"Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security"},"content":{"rendered":"\n<p>The<a href=\"https:\/\/www.standard.co.uk\/news\/london\/hammersmith-fulham-council-cyberattacks-b1210208.html\"> recent cyberattacks<\/a> on London councils have exposed a fundamental weakness in today\u2019s cybersecurity strategies. Despite organisations investing heavily in perimeter defences such as firewalls, anti-phishing measures, and zero-trust policies, cybercriminals continue to breach these barriers. The reason? Traditional best practices focus on keeping attackers out, rather than protecting what truly matters; the data itself. <strong>Simon Pamplin, Chief Technology Officer at<\/strong><a href=\"http:\/\/certes.ai\"><strong> <\/strong><\/a><a href=\"http:\/\/certes.ai\"><strong>Certes<\/strong><\/a><strong>,<\/strong> discusses.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a><strong>Perimeter defences are no longer enough<\/strong><\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignright size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"1024\" src=\"https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-1024x1024.jpg\" alt=\"\" class=\"wp-image-9642\" style=\"width:217px;height:auto\" srcset=\"https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-1024x1024.jpg 1024w, https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-300x300.jpg 300w, https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-150x150.jpg 150w, https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-768x768.jpg 768w, https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-1536x1536.jpg 1536w, https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-2048x2048.jpg 2048w, https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-400x400.jpg 400w, https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-144x144.jpg 144w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Simon Pamplin<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<p>The stakes in cybersecurity have never been higher. Attackers no longer rely on brute-force break-ins; instead, they exploit stolen credentials to log in undetected. Studies show that over<a href=\"https:\/\/www.gov.uk\/government\/statistics\/cyber-security-breaches-survey-2024\/cyber-security-breaches-survey-2024\"> <\/a><a href=\"https:\/\/www.gov.uk\/government\/statistics\/cyber-security-breaches-survey-2024\/cyber-security-breaches-survey-2024\">84% of breaches<\/a> now involve credential theft, allowing cybercriminals to bypass traditional security measures entirely.<\/p>\n\n\n\n<p>Meanwhile, the financial impact of these breaches is soaring. Ransomware<a href=\"https:\/\/certes.ai\/wp-content\/uploads\/2024\/11\/Cyber-Insights-Infographic.pdf\"> <\/a><a href=\"https:\/\/certes.ai\/wp-content\/uploads\/2024\/11\/Cyber-Insights-Infographic.pdf\">demands have skyrocketed,<\/a> with the average ransom payment now exceeding<a href=\"https:\/\/www.infosecurity-magazine.com\/news\/ransom-payments-surge-500\/\"> <\/a><a href=\"https:\/\/www.infosecurity-magazine.com\/news\/ransom-payments-surge-500\/\">$2 million<\/a>; a staggering increase from $400,000 just a year ago. But the costs extend far beyond ransom payments. Organisations face an average of $2.73 million in recovery costs, not to mention the reputational damage that follows, often leading to lost customers and diminished trust.<\/p>\n\n\n\n<p>For public sector organisations, the fallout can be even more severe. Data breaches in government agencies and councils compromise sensitive personal data, eroding public confidence and triggering regulatory scrutiny. Despite these risks, many organisations still rely on outdated security models that focus solely on network protection. But when attackers are logging in rather than breaking in, traditional defences offer little protection.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a><strong>The business impact: more than just financial losses<\/strong><\/h3>\n\n\n\n<p>Cybersecurity is no longer just an IT issue; it\u2019s a boardroom crisis. Regulatory bodies such as GDPR, DORA, and NIS2 impose hefty fines on organisations that fail to secure data adequately. For financial institutions, non-compliance with DORA alone can lead to penalties of up to 2% of global revenue.<\/p>\n\n\n\n<p>Beyond financial losses, reputational damage can be devastating. Customers and clients expect their data to be handled securely, and a single breach can drive them away permanently. Operational downtime resulting from an attack can halt productivity, costing millions in lost revenue. Perhaps most concerning, executives now face personal liability for failing to protect sensitive data. CEOs and CISOs are increasingly being held accountable, meaning cybersecurity failures could have career-ending consequences.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u00a0The shift to data-centric security<\/strong><\/h3>\n\n\n\n<p>If cybercriminals are after data, why is security still focused on protecting the perimeter? It\u2019s time for organisations to shift their mindset and prioritise a data-centric security approach. The fundamental principle of this approach is simple: assume breaches will happen and ensure that, if they do, the stolen data is worthless to attackers.<\/p>\n\n\n\n<p>This is where solutions like Data Protection and Risk Mitigation (DPRM) become essential. By encrypting, tokenising, or otherwise devaluing sensitive data, organisations can render stolen information unreadable and unusable. Even if attackers successfully infiltrate a network, they won\u2019t be able to exploit the data they access.<\/p>\n\n\n\n<p>Equally important is protecting backups. Many organisations fall into the trap of securing live data but neglecting backup systems. Cybercriminals often target backups in ransomware attacks, leaving businesses with no choice but to pay up. A robust backup protection strategy, incorporating immutable backups and air-gapped storage, is vital in mitigating ransomware risks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a><strong>The ultimate defence: a multi-layered approach<\/strong><\/h3>\n\n\n\n<p>Creating an impenetrable defence may seem like a pipe dream, but a multi-layered security model that neutralises threats before they cause harm is achievable. A comprehensive approach should include:<\/p>\n\n\n\n<p>\u25cf&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; <strong>Proactive security measures<\/strong>: Implementing encryption, tokenisation, and access controls to devalue data.<\/p>\n\n\n\n<p>\u25cf&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; <strong>Regulatory compliance<\/strong>: Adhering to frameworks like GDPR and DORA to mitigate legal and financial risks.<\/p>\n\n\n\n<p>\u25cf&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; <strong>Rapid recovery capabilities<\/strong>: Ensuring businesses can resume operations quickly after an attack, minimising downtime and financial losses.<\/p>\n\n\n\n<p>\u25cf&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; <strong>Advanced threat detection<\/strong>: Using AI-driven analytics to identify and stop threats before they escalate.<\/p>\n\n\n\n<p>By integrating these elements into a unified security strategy, organisations can not only defend against cyber threats but also maintain business continuity and protect their reputations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a><strong>The future of cybersecurity: act now or pay later<\/strong><\/h3>\n\n\n\n<p>Ransomware and data breaches are not just technical threats; they represent financial, operational, and reputational crises. The reality is clear: perimeter defences alone are failing, and organisations must act now to protect what truly matters.<\/p>\n\n\n\n<p>Building higher walls will not stop attackers. Instead, businesses and public sector organisations must invest in making the data itself untouchable. By shifting to a data-centric security approach, implementing robust encryption, and ensuring resilience through protected backups, organisations can render cyberattacks ineffective.<\/p>\n\n\n\n<p>Cybersecurity is no longer about preventing breaches altogether\u2014it\u2019s about making stolen data useless. Until organisations embrace this mindset, breaches will remain inevitable. The time to rethink security is now.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"\n<p>The recent cyberattacks on London councils have exposed a fundamental weakness in today\u2019s cybersecurity strategies. Despite organisations investing heavily in perimeter defences such as firewalls, anti-phishing measures, and zero-trust policies, cybercriminals continue to breach these barriers. The reason? Traditional best practices focus on keeping attackers out, rather than protecting what truly matters; the data <\/p>\n<p>Continue reading <a href=\"https:\/\/www.gpsj.co.uk\/?p=9641\">Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security<\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[1],"tags":[4441,2486,1147,25,417,26,264,738,310,416,422,2604],"class_list":["post-9641","post","type-post","status-publish","format-standard","hentry","category-it-it-security","tag-certes","tag-cyberattack","tag-cybersecurity","tag-government-public-sector-journal","tag-government-journal","tag-gpsj","tag-gpsj-magazine","tag-it-security","tag-public-sector","tag-public-sector-journal","tag-public-sector-magazine","tag-technology","odd"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security - Government &amp; Public Sector Journal<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.gpsj.co.uk\/?p=9641\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security - Government &amp; Public Sector Journal\" \/>\n<meta property=\"og:description\" content=\"The recent cyberattacks on London councils have exposed a fundamental weakness in today\u2019s cybersecurity strategies. Despite organisations investing heavily in perimeter defences such as firewalls, anti-phishing measures, and zero-trust policies, cybercriminals continue to breach these barriers. The reason? Traditional best practices focus on keeping attackers out, rather than protecting what truly matters; the data Continue reading Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.gpsj.co.uk\/?p=9641\" \/>\n<meta property=\"og:site_name\" content=\"Government &amp; Public Sector Journal\" \/>\n<meta property=\"article:published_time\" content=\"2025-03-24T12:08:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-03-24T12:09:36+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"2560\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"The GPSJ Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"The GPSJ Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641\"},\"author\":{\"name\":\"The GPSJ Team\",\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/#\\\/schema\\\/person\\\/d54386f99736367ec2789825fed93b4a\"},\"headline\":\"Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security\",\"datePublished\":\"2025-03-24T12:08:42+00:00\",\"dateModified\":\"2025-03-24T12:09:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641\"},\"wordCount\":792,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.gpsj.co.uk\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/SimonPamplin_Certes-1024x1024.jpg\",\"keywords\":[\"Certes\",\"Cyberattack\",\"Cybersecurity\",\"Government &amp; Public Sector Journal\",\"Government Journal\",\"GPSJ\",\"GPSJ Magazine\",\"IT Security\",\"public sector\",\"Public Sector Journal\",\"Public Sector Magazine\",\"Technology\"],\"articleSection\":[\"IT &amp; IT Security\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641\",\"url\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641\",\"name\":\"Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security - Government &amp; Public Sector Journal\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.gpsj.co.uk\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/SimonPamplin_Certes-1024x1024.jpg\",\"datePublished\":\"2025-03-24T12:08:42+00:00\",\"dateModified\":\"2025-03-24T12:09:36+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/#\\\/schema\\\/person\\\/d54386f99736367ec2789825fed93b4a\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641#primaryimage\",\"url\":\"https:\\\/\\\/www.gpsj.co.uk\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/SimonPamplin_Certes-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/www.gpsj.co.uk\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/SimonPamplin_Certes-scaled.jpg\",\"width\":2560,\"height\":2560},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?p=9641#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.gpsj.co.uk\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/#website\",\"url\":\"https:\\\/\\\/www.gpsj.co.uk\\\/\",\"name\":\"Government &amp; Public Sector Journal\",\"description\":\"Public Sector, Government, business, stories and news along with latest developments, research, thought leadership, strategy, policy and insights\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.gpsj.co.uk\\\/#\\\/schema\\\/person\\\/d54386f99736367ec2789825fed93b4a\",\"name\":\"The GPSJ Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/13cdd73dc4abbd6e05b80a0562c7c553a9104ad2e5e96ee20afca2c462894143?s=96&d=blank&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/13cdd73dc4abbd6e05b80a0562c7c553a9104ad2e5e96ee20afca2c462894143?s=96&d=blank&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/13cdd73dc4abbd6e05b80a0562c7c553a9104ad2e5e96ee20afca2c462894143?s=96&d=blank&r=g\",\"caption\":\"The GPSJ Team\"},\"sameAs\":[\"http:\\\/\\\/gpsj.co.uk\"],\"url\":\"https:\\\/\\\/www.gpsj.co.uk\\\/?author=3\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security - Government &amp; Public Sector Journal","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.gpsj.co.uk\/?p=9641","og_locale":"en_GB","og_type":"article","og_title":"Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security - Government &amp; Public Sector Journal","og_description":"The recent cyberattacks on London councils have exposed a fundamental weakness in today\u2019s cybersecurity strategies. Despite organisations investing heavily in perimeter defences such as firewalls, anti-phishing measures, and zero-trust policies, cybercriminals continue to breach these barriers. The reason? Traditional best practices focus on keeping attackers out, rather than protecting what truly matters; the data Continue reading Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security","og_url":"https:\/\/www.gpsj.co.uk\/?p=9641","og_site_name":"Government &amp; Public Sector Journal","article_published_time":"2025-03-24T12:08:42+00:00","article_modified_time":"2025-03-24T12:09:36+00:00","og_image":[{"width":2560,"height":2560,"url":"https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-scaled.jpg","type":"image\/jpeg"}],"author":"The GPSJ Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"The GPSJ Team","Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.gpsj.co.uk\/?p=9641#article","isPartOf":{"@id":"https:\/\/www.gpsj.co.uk\/?p=9641"},"author":{"name":"The GPSJ Team","@id":"https:\/\/www.gpsj.co.uk\/#\/schema\/person\/d54386f99736367ec2789825fed93b4a"},"headline":"Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security","datePublished":"2025-03-24T12:08:42+00:00","dateModified":"2025-03-24T12:09:36+00:00","mainEntityOfPage":{"@id":"https:\/\/www.gpsj.co.uk\/?p=9641"},"wordCount":792,"commentCount":0,"image":{"@id":"https:\/\/www.gpsj.co.uk\/?p=9641#primaryimage"},"thumbnailUrl":"https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-1024x1024.jpg","keywords":["Certes","Cyberattack","Cybersecurity","Government &amp; Public Sector Journal","Government Journal","GPSJ","GPSJ Magazine","IT Security","public sector","Public Sector Journal","Public Sector Magazine","Technology"],"articleSection":["IT &amp; IT Security"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.gpsj.co.uk\/?p=9641#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.gpsj.co.uk\/?p=9641","url":"https:\/\/www.gpsj.co.uk\/?p=9641","name":"Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security - Government &amp; Public Sector Journal","isPartOf":{"@id":"https:\/\/www.gpsj.co.uk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.gpsj.co.uk\/?p=9641#primaryimage"},"image":{"@id":"https:\/\/www.gpsj.co.uk\/?p=9641#primaryimage"},"thumbnailUrl":"https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-1024x1024.jpg","datePublished":"2025-03-24T12:08:42+00:00","dateModified":"2025-03-24T12:09:36+00:00","author":{"@id":"https:\/\/www.gpsj.co.uk\/#\/schema\/person\/d54386f99736367ec2789825fed93b4a"},"breadcrumb":{"@id":"https:\/\/www.gpsj.co.uk\/?p=9641#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.gpsj.co.uk\/?p=9641"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.gpsj.co.uk\/?p=9641#primaryimage","url":"https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-scaled.jpg","contentUrl":"https:\/\/www.gpsj.co.uk\/wp-content\/uploads\/2025\/03\/SimonPamplin_Certes-scaled.jpg","width":2560,"height":2560},{"@type":"BreadcrumbList","@id":"https:\/\/www.gpsj.co.uk\/?p=9641#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.gpsj.co.uk\/"},{"@type":"ListItem","position":2,"name":"Why \u201cBest Practice\u201d is Failing to Protect Personal Data: A Call for Data-Centric Security"}]},{"@type":"WebSite","@id":"https:\/\/www.gpsj.co.uk\/#website","url":"https:\/\/www.gpsj.co.uk\/","name":"Government &amp; Public Sector Journal","description":"Public Sector, Government, business, stories and news along with latest developments, research, thought leadership, strategy, policy and insights","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.gpsj.co.uk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/www.gpsj.co.uk\/#\/schema\/person\/d54386f99736367ec2789825fed93b4a","name":"The GPSJ Team","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/secure.gravatar.com\/avatar\/13cdd73dc4abbd6e05b80a0562c7c553a9104ad2e5e96ee20afca2c462894143?s=96&d=blank&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/13cdd73dc4abbd6e05b80a0562c7c553a9104ad2e5e96ee20afca2c462894143?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/13cdd73dc4abbd6e05b80a0562c7c553a9104ad2e5e96ee20afca2c462894143?s=96&d=blank&r=g","caption":"The GPSJ Team"},"sameAs":["http:\/\/gpsj.co.uk"],"url":"https:\/\/www.gpsj.co.uk\/?author=3"}]}},"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.gpsj.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/9641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gpsj.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gpsj.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gpsj.co.uk\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gpsj.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9641"}],"version-history":[{"count":6,"href":"https:\/\/www.gpsj.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/9641\/revisions"}],"predecessor-version":[{"id":9649,"href":"https:\/\/www.gpsj.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/9641\/revisions\/9649"}],"wp:attachment":[{"href":"https:\/\/www.gpsj.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gpsj.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gpsj.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}