Protect personal information
Short label: GDPR
Meaning
Personal information is information about identifiable people, including staff and customers. The GDPR governs its use and protection.
Why it matters
Security, permitted use, retention and people’s rights all need attention; a hosting country alone does not settle them.
What you can do
Know which information you hold, why you use it and who can access it. Assess breach-notification duties against the actual event and applicable conditions.
Services that can help
Sovereign Storage, Private AI and Web App Shield provide different technical measures. The organisation still manages its wider data-protection responsibilities.
Official reference — GDPR Art. 32
1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data; (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
— Regulation (EU) 2016/679 (GDPR), Art. 32(1)
Personal data must be protected by measures that fit the risk: encryption, systems that stay available, restore after an incident, and regular testing.
Read the article on EUR-Lex → · Official text, quoted from the Official Journal of the EU
Acronyms used here: NIS2, GDPR, DORA, CRA
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.