docupike - technical and organizational measures

1. Confidentiality (Art. 32 §1 lit. b DS-GVO)

1.1 Access control: Unauthorised persons must be denied access to rooms in which data processing equipment is located.

Definition of security areas:

Implementation of effective accessprotection
Determination of persons withauthorised access
Administration of personal accessauthorisations
Supervision of external personnel

1.2 Access control: Preventing data processing systems from being used by unauthorised persons.

Access protection
Implementation of secure access procedures, strong authentication
Implementation of simple authentication by username password
Logging of access for critical systems
Monitoring of critical IT systems
Secure (encrypted) transmission of authentication secrets
Blocking in case of failed attempts/activity and process for resetting blocked access IDs
Prohibition of storage function for passwords and/or form entries (server/clients)
Determination of authorised persons
Management and documentation of personal authentication media and access authorisations
Automatic access blocking and manual access blocking

1.3 Only data for which access authorisation exists can be accessed. Data cannot be read, copied, modified or removed without authorisation during processing, use or after storage:

Creation of an authorisation concept
Implementing access restrictions
Avoiding the concentration of functions

1.4 Purpose control: It must be ensured that data collected for different purposes can be processed separately:

Data economy in handling personal data
Separate processing of different data sets
Separation of test and development environment

1.5 Data protection-friendly default settings: If data is not required to achieve the purpose of use, the technical default settings are defined in such a way that data is only collected, processed, passed on or published as a result of an action by the data subject.

2. Integrity (Art. 32 §1 lit. b DS-GVO)

2.1 Transfer control: the aim of transfer control is to ensure that personal data cannot be read, copied, altered or removed without authorisation during electronic transmission or during its transport or storage on data carriers, and that it is possible to verify and establish to which entities personal data is intended to be transferred by data transmission equipment.

Determination of entities/persons authorised to receive/transmit data
Secure data transfer between server and client
Secure transmission in the backend
Secure transmission to external systems
Risk minimization through network separation
Implementation of security gateways at the network transfer points
Hardening of the backend systems
Description of interfaces
Implementation of machine-to-machine authentication
Secure storage of data, including backups

2.2 Input control: The purpose of input control is to ensure that it is possible to check and determine retrospectively whether and by whom personal data has been entered, modified or removed from data processing systems.

Logging of inputs

3. Availability, resilience, disaster recovery

3.1 Availability and resilience (Art. 32 §1 lit. b DSGVO)

Monitoring
Resource planning and provisioning
Defense against misuse that burdens the system
Data backup concepts and implementation

3.2 Disaster Recovery - Rapid Recovery from Incident (Art. 32 §1 lit. c GDPR)

Emergency plan
Data protection concepts and implementation

4. Data protection organization

Definition of responsibilities
Implementation and control of appropriate processes
Implementation of training measures
Commitment to confidentiality
Regulations on the internal allocation of tasks
Observance of separation of functions and allocation
Introduction of suitable deputy regulations

5. Order control

The aim of order control is to ensure that personal data processed on behalf of the client can only be processed in accordance with the client's instructions.

Selection of further contractors according to suitable guarantees
Conclusion of an agreement on commissioned processing with further contractors
Conclusion of an agreement on commissioned processing with xyz

6. Process for regular review, assessment and evaluation (Art. 32 §1 lit. d GDPR; Art. 25 §1 DS-GVO)