Instructions and attachments

Instructions

The GDPR PRIVACY PRO privacy management system, in addition to the procedures that govern the processes, also includes instructions to be provided to the organization’s personnel, that is, to those authorized to apply physical and technological security measures.

They are particularly useful from a practical point of view because they establish how to prevent risks to personal data during processing. They are distinguished as follows:

Control access to personal data

• ISTR-05-A Physical access control
• ISTR-05-B Password
• ISTR-05-C Multi-factor authentication

Control operational activities

• ISTR-05-D Log management
• ISTR-05-E Anonymization
• ISTR-05-F Pseudonymization
• ISTR-05-G Antivirus
• ISTR-05-H Firewall and IPS

Preserve the working environment

• ISTR-05-I RFID control
• ISTR-05-L Fire protection
• ISTR-05-M UPS

Store data

• ISTR-05-N Cabinets, safe drawers
• ISTR-05-O Backup
• ISTR-05-P Encryption
• ISTR-05-Q Video surveillance

Other security measures for personnel management

In addition to the privacy security measures regulated by the Instructions (physical and technological measures), the GDPR PRIVACY PRO system also provides for organizational measures aimed at controlling the personnel who carry out the processing, which are documented in the following modules:

• MOD-03-B Privacy policy and objectives
• MOD-04-I Training register
• MOD-04-N Privacy due diligence
• MOD-04-M Confidentiality agreement
• MOD-04-P Privacy disciplinary procedure
• MOD-04-O Communication and whistleblowing
• MOD-03-A Internal privacy roles and responsibilities

Attachments

Among the documents belonging to the category of “Attachments”, the system uses the attachment ALL-01 Dangers and risks for natural persons in the privacy area

The attachment reports, in a schematic and tabular manner, information that must absolutely be transferred to those authorised to process personal data. The entire organisation must acquire awareness of what the real “Privacy” concerns are for which it is necessary to pay so much attention to the fulfilment and active protection of the interested parties

The information intended to “tune” the attention of the data controller and the entire organisation on the real dangers present in the Information Society concerns:

• The profiles, types and motivations of criminals operating with personal data

This section contains the downloadable examples of Instructions & Attachments