This article by Andrew Cormack first discusses the need to prevent, detect and remedy security incidents, and the different types of data processing these involve. It then reviews the diverse treatment of these activities under existing laws and the difficulties this has created. In search of a more consistent alternative, following the lead of the Regulation, it considers the legal requirements and guidance when processing personal data for legitimate interests, concluding that existing incident response practice largely satisfies them. From these requirements and guidance it derives a framework to guide the work of incident response teams and applies this to common incident response activities.
You can read full article here.
