The Data Protection Officer (or other responsible person) has drawn up operating instructions for personnel handling personal data. In addition, the Data Protection Officer is ready to advise the controller, personal data processing partners or their own staff on compliance with GDPR or other data protection requirements.
A process for reporting incidents is maintained to help staff report incidents efficiently and consistently.
Things to report as an incident include e.g.:
The personnel guidelines emphasize the obligation to report security incidents as soon as possible in accordance with the agreed process. The instructions also describe other operations in the event of an incident (e.g. recording seen error messages and other details).
Data classification can be used to give data processors a quick view of how critical data is and how data should be processed and protected.
The data categories used and the corresponding security levels are defined. The category of information is defined by analyzing the confidentiality, integrity and availability of the information in question, as well as any other requirements. Each level is given a clear and descriptive name.
Data classifications can be, for example, the following:
CONFIDENTIAL paper information may require e.g. the following protections:
CONFIDENTIAL electronic information may require e.g. the following protections:
The dataset owners (or the owners of the related information asset, such as a data store or data system) are responsible for the classifications of the datasets and the correspondence of the classification to the definitions of the classes.
The owner updates the data classification over the life cycle of the asset according to variations in its value, sensitivity, and criticality.
Especially when local or unstructured data needs to be handled a lot due to the nature of the activity, it may be necessary to develop training that describes the risks involved for staff.
Common problems with local and unstructured data include e.g.:
For data you do not want to lose, that you want to control, or that is important to find in the future, staff should use data systems designed for it.
Papers containing sensitive information should be disposed of in an agreed manner, for example, using a shredder or by incineration.
Organisaation on huomioitava henkilöstön salassapidettävien tietojen turvallisen tuhoamisen prosesseissa. Organisaation tulee järjestää henkilöstölle yksikäsitteinen tapa tietojen tuhoamiseen ja ohjeistaa relevanttia henkilöstöä tämän tavan käyttämisessä.
The ways in which information is classified and classifications marked are defined, markings are easily identifiable and they cover both physical and electronic information and assets. The marking must indicate to what extent the document is to be kept secret and on what basis the secrecy is based. Personnel are instructed on how to make markings.
Unnecessary media should be disposed of in a safe, industry-accepted manner (such as by incineration, shredding or wiping) in accordance with formal procedures. Media that requires safe disposal must be clearly marked.
Data destroyed in accordance with the process should not be recoverable, even by forensic means.
There are agreed procedures for identifying and marking media that require safe disposal.