The French data protection supervisory authority CNIL has updated a guide on data security from 2010 and adapted it to the DSGVO. The guide is up to date from 2010 Available in English, the new version for the time being only in French.
The data security principle (Art. 32 GDPR) aims at an appropriate management of data protection risks. For this risk management, the CNIL recommends a four-step approach:
- Acquisition of the data processing
- Risk assessment:
- Determination of the potential impact on affected persons in three scenarios: (i) unauthorized access to personal data; (ii) unwanted modification of personal data, (iii) loss of data. Examples of undesired effects would include identity theft, unjustified accusations as a result of inaccurate data, overlooking side effects in a medical treatment because medical data was lost).
- Determination of the sources of risk, i.e., internal as well as external and human as well as other hazards;
- Determination of risk scenarios, i.e., the circumstances that may lead to a risk occurring;
- Determination of the existing or possible measures for security, i.e. technical and organizational security measures;
- Probability assessment of the occurrence of risk;
- Risk mitigation measures take and check
- Regular Safety checks
The second stage, risk assessment, can be presented as follows:
The guide then describes technical and organizational security measures in accordance with the GDPR in 17 chapters:
- Sensibiliser les utilisateurs
- Authentifier les utilisateurs
- Gérer les habilitations
- Tracer les accès et gérer les incidents
- Sécuriser les postes de travail
- Sécuriser l’informatique mobile
- Protéger le réseau informatique interne
- Sécuriser les serveurs
- Sécuriser les sites web
- Sauvegarder et prévoir la continuité d’activité
- Archiver de manière sécurisée
- Encadrer la maintenance et la destruction des données
- Gérer la sous-traitance
- Sécuriser les échanges avec d’autres organismes
- Protéger les locaux
- Encadrer les développements informatiques
- Chiffrer, garantir l’intégrité ou signer