PROPUESTA DE UN PLAN DE IMPLEMENTACIÓN PARA EL CUMPLIMIENTO DE LA LEY ORGÁNICA DE PROTECCIÓN DE DATOS PERSONALES EN LA EMPRESA CABLETEL

Abstract

Cabletel must be aligned with the new law on personal data protection because, since 2023, all companies that handle user data are obliged to comply with this regulation. Therefore, this work focuses on evaluating Cabletel's security levels concerning protecting personal information. The study answers the question: How can Cabletel strengthen its information security and ensure compliance with the legal requirements established by the current regulations? Through the analysis of the LOPDP and ISO 27002, plan to identify and implement control objectives by the company and development of recommendations to strengthen security processes. The methodology was based on the qualitative, descriptive approach, and the Capability Maturity Model Integration (CMMI) model was used. A literature review related to the LOPDP and ISO 27002 was conducted. In addition, surveys were applied to the person in charge of the ICT department to evaluate the integration of the control objectives. The results indicate that Cabletel complies with 79% of the specific controls identified in ISO 27002; in turn, they are linked to the requirements established by the LOPDP. The maturity level of each identified control was also determined, representing 72% of stability and consistency. Based on these results, recommendations were suggested to ensure compliance with these requirements and avoid the sanctions established by law. Keyword: Personal data protection, Compliance, Regulations, Sanctions, ISO/IEC 27002:2013 Standard