Your business has implemented appropriate technical and organisational measures to show you have considered and integrated data protection into your processing activities.
Protection mechnisms
Create encryption policies and procedures for relevant technologies, including what personal data to encrypt, how to encrypt it, and why to encrypt it. Regularly update these policies and procedures.
Your business has effective processes to identify, report, manage and resolve any personal data breaches. BEIS must be notified within 48 hours about any breaches involving personal data being processed on our behalf.
Chapter 4: Controller and processor
Section 2: Security of personal data
Art. 33 GDPR: Notification of a personal data breach to the supervisory authority
Recital 85: Notification Obligation of Breaches to the Supervisory Authority
Recital 87: Promptness of Reporting / Notification
All activities are logged on the server side and therefore for the enduser unavailable area. The logging fully indicate all activity within the product duriong specific times.
All activities are logged in a seperated and for the enduser unavailable area. Logging is stored on the Enuser Mobile device, but also on the server side.
By default all handled activities for Authentication, Autorisation and Accounting are logged. Providing a complete audit trail when needed.
Maintain the principle of least privilege for all personal data. Document this consideration in relevant policies and procedures. Create a procedure to continually validate that least privilege to personal data is maintained.
Chapter 4: Controller and processor
Section 4: Data protection officer
Art. 39 GDPR: Tasks of the data protection officer
Recital 97: Data Protection Officer
G/On is build on the model of leas priviledge access. Required Access needs to be configured. There is no implicit access in G/On
G/On continuesly monitors the connection and wil terminate the connection based on suspicios actifity
Access restrictions are enforces by the NetAttest EPS. Next the EPS provides the ability for granulair Robe Based Access based on a Digital Certificates.