Technical organizational measures
1. Confidentiality (Art. 32 para. 1 lit. b GDPR)
1.1 Access control
Unauthorized persons must be denied access to rooms in which data processing systems are located. Determination of security areas
- Implementation of effective access protection
- Logging of access
- Determination of authorized access persons
- Management of personal access authorizations
- Accompanying external staff
- Monitoring of the rooms
1.2 Access Control
It must be prevented that data processing systems are used by unauthorized persons.
- Determination of protection needs
- Access protection
- Implementation of secure access procedures, strong authentication
- Implementation of simple authentication via username/password
- Logging of access
- Monitoring of critical IT systems
- Secured (encrypted) transmission of authentication secrets
- Lockout on failed attempts/inactivity and lockout reset process
- Access IDs
- Prohibition of storage function for passwords and/or form entries (server/clients)
- Determination of authorized persons
- Management and documentation of personal authentication media and access permissions
- Automatic access blocking and manual access blocking
1.3 Access Control
Only the data for which access authorization exists can be accessed. Data cannot be read, copied, changed or removed without authorization during processing, use and after storage.
- Creating an authorization concept
- Implementation of access restrictions
- Granting minimal permissions
- Management and documentation of personal access authorizations
- Avoid concentration of functions
1.4 Intended use control
It must be ensured that data collected for different purposes can be processed separately.
- Data economy when handling personal data
- Separate processing of different data sets
- Regular intended use control and deletion
- Separation of live/test and development environments
1.5 Privacy-Friendly Presets
If data is not required to achieve the intended purpose, the technical default settings are set so that data is only collected, processed, passed on or published through an action by the data subject.
2. Integrity (Art. 32 para. 1 lit. b GDPR)
2.1 Transfer control
The aim of transfer control is to ensure that personal data cannot be read, copied, changed or removed without authorization during electronic transmission or during its transport or storage on data media, and that it can be checked and determined to which locations a transfer has been made personal data is provided by data transmission facilities.
- Determination of entities/persons authorized to receive/transmit
- Checking the legality of the transfer abroad
- Logging of transmissions according to the logging concept
- Secure data transfer between server and client
- Securing the transfer in the backend
- Secure transmission to external systems
- Risk minimization through network separation
- Implementation of security gateways at the network transfer points
- Hardening of backend systems
- Description of the interfaces
- Implementation of machine-machine authentication
- Secure storage of data, including backups
- Secured storage on mobile storage media
- Introduction of a process for disk management
- Collection and disposal process
- Data protection-compliant deletion and destruction procedures
- Keeping deletion logs
2.2 Input control
The purpose of input control is to ensure that it can be subsequently checked and determined whether and by whom personal data has been entered, changed or removed into data processing systems.
- Logging of entries
- Documentation of input authorizations
3. Availability, resilience, disaster recovery
3.1 Availability and resilience (Art. 32 para. 1 lit. b GDPR)
- Fire protection
- Redundancy of the primary technology
- Power supply redundancy
- Redundancy of communication connections
- Monitoring
- Resource planning and deployment
- Protection against abuse that puts a strain on the system
- Data backup concepts and implementation
- Regular inspection of emergency facilities
3.2 Disaster recovery – rapid recovery after an incident (Art. 32 para. 1 lit. c GDPR)
- Emergency plan
- Data backup concepts and implementation
4. Data Protection Organization
- Establishing responsibilities
- Implementation and control of appropriate processes
- Reporting and release process
- Implementation of training measures
- Commitment to confidentiality
- Regulations for the internal distribution of tasks
- Introduction of a suitable representative regulation
5. Order Control
The aim of order control is to ensure that personal data processed in the order can only be processed in accordance with the instructions of the client.
- Selection of additional contractors based on suitable guarantees
- Conclusion of an agreement for order processing with other contractors
6. Procedure for regular review, assessment and evaluation (Art. 32 Para. 1 lit. d GDPR; Art. 25 Para. 1 GDPR)
- Information security management
- Process for evaluating the technical and organizational measures
- Security incident management process
- Carrying out technical reviews