Cybersecurity Consulting
Personal Data Security Measures Consulting
We identify systems holding personal data and implement the technical and organizational measures required by data protection law on them. Each measure is verified in system settings, not just documented.
What it is
Data protection laws such as GDPR require organizations to ensure appropriate technical and organizational measures for personal data. Authorization matrix, access logs, encryption and penetration testing are examples of technical measures. Processing inventory, risk analysis and contracts with data processors are organizational measures. Each measure is applied directly on the system where the personal data resides.
Scope
- Identifying which systems, applications and data flows hold personal data
- Preparing the authorization matrix and removing unnecessary access
- Collecting access and transaction logs and protecting them from unauthorized changes
- Encryption and key management for databases, backups and file shares
- Additional safeguards for special categories of personal data such as health data
- Data breach response plan and notification flow to the authority
The need
When organizations need it
- When legal compliance is complete but it is unclear how technical measures are implemented on your systems.
- When you process special categories of personal data such as health, biometric or genetic data.
- When the data protection authority initiates an inquiry after a complaint or alleged breach.
Method
How we work
-
Data map
We map the data categories in your inventory to the systems and applications where they are held.
-
Gap analysis
We check each measure on these systems individually and prioritize the gaps by risk.
-
Implementation
We adjust access, logging, encryption and backup settings with your teams.
-
Evidence
We collect the configuration record and test result for each measure in an evidence file.
Outcome
What you have at the end
You have a table showing which measure is implemented on each system holding personal data, supported by an evidence file. In an inquiry or after a breach, you can document the measures taken.
Frequently asked questions
Our lawyers completed our data protection compliance. Why is this needed?
Legal work covers privacy notices, consent and the processing inventory. The security measures required by law must be implemented on the systems. The two are complementary.
Are registration with the authority and written policies sufficient?
No. These are organizational measures. Technical measures such as access control, logging and encryption must also be implemented on the systems.
How soon must we report a data breach?
Under GDPR, a notifiable breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours. The response plan defines in advance the decisions and communication steps needed to meet this deadline.
Cybersecurity Consulting
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting