Technical and Organisational Measures (TOMs)

Last updated

Description: Technical and organisational measures of the Interactive Paper GmbH

Introduction

The Processor shall ensure appropriate technical and organisational measures that comply with the state of the art, that take into account the implementation costs as well as the specific risks and that are suitable to effectively safeguard an appropriate level of protection of the rights of data subjects. The Controller shall assess the risks to the rights and freedoms of natural persons associated with the processing and implement measures to mitigate those risks.

The state of the art describes advanced procedures, facilities and operating methods that can, according to prevalent opinion of leading experts, achieve the legally required goals in data protection and security. Procedures, facilities and operating methods or comparable procedures, facilities and operating methods must have proven themselves in practice or - if this is not yet the case - should, if possible, have been successfully tested in operation.

In order to document the implementation of the technical and organisational measures, the Processor shall provide the Controller with a data protection report describing the actual implementation of the technical and organisational measures upon the Controller's request. The Controller reserves the right to request the data protection report periodically (once a year) or on an ad hoc basis. The Processor shall provide the data protection report to the controller within a reasonable period of time without charging any costs to the Controller. The structure of the data protection report is as follows, but may be narrower or broader depending on the needs and instructions of the Controller:

Access control

Unauthorised persons shall be prohibited from accessing the facilities where personal data are processed. The Processor shall implement the following access control measures:

  1. Surveillance system with alarm system, video/television monitor
  2. Door security (personal keys, electric door openers, individual entry, etc.)
  3. Lockable room
  4. Lockable computer cabinets/units
  5. Access authorisations are exclusively assigned according to an access regulation
  6. Screens not in the field of vision of unauthorised persons and bystanders
  7. Access and tap-proof cable laying
  8. Signed confidentiality agreement before entering the office premises.

Data carrier control

Unauthorised persons must be prevented from reading, copying, changing or removing data carriers. The measures are defined in 3.3. "Storage control"

Storage control

Unauthorised storage, as well as unauthorised inspection, modification or deletion of stored personal data must be prevented. The Processor shall implement the following measures within the scope of storage control:

  1. Personal data is stored exclusively for a specific purpose, separately from data stored for other purposes (e.g. in test and production environments).
  2. The storage is separate from the data of other clients (e.g. in the case of multi-client capability of the corresponding applications and the underlying database systems)
  3. The storage takes place exclusively temporarily in a virtual system (sandbox) assigned to the client
  4. Contractual agreements with partner companies
  5. Disclosure of personal data internally, as well as to third parties (production partners) only takes place through encrypted data records

Usage control

To prevent unauthorized access to automated data processing systems, particularly through data transmission equipment (e.g., remote access), the following measures are implemented as part of the data media control:

  1. User Rights Management
    1. User rights are assigned exclusively by system administrators, ensuring that only authorized personnel have access to specific systems and data.
    2. Each user is provided with a separate, unique user account to maintain accountability and traceability.
  2. Login Procedures and Password Security
    1. User logins require a secure user ID and password, adhering to company-wide password policies.
    2. Initial passwords assigned by administrators must be changed immediately upon first login by the user to ensure they are known only to the user.
    3. Passwords must meet security criteria, including a minimum length of 10 characters, inclusion of characters from at least three of the following categories: uppercase letters, lowercase letters, numbers, and special characters. Insecure passwords are rejected.
    4. Passwords have a defined expiration period, with regular forced changes to enhance security.
  3. Two-Factor Authentication (2FA)
    User logins are protected by two-factor authentication (2FA) to add an additional layer of security, particularly for remote access to systems.
  4. Password Encryption and Storage
    All passwords are stored using encrypted, one-way encryption methods or salted hash values to prevent unauthorized access.
  5. Login Monitoring and Security Protocols
    1. Logins and failed login attempts are logged for monitoring and audit purposes.
    2. In the event of multiple failed login attempts, accounts are automatically blocked or paused to prevent brute force attacks.
    3. Users and their profiles are assigned to specific workstations, ensuring that access is limited to designated areas.
  6. Security Activation and Safeguards
    1. Service company identifiers (e.g., accounts or access codes) are only activated when necessary, reducing exposure to unauthorized access.
    2. Password-protected screensavers are enforced to secure systems when left unattended.
  7. Cybersecurity Awareness and Training
    1. A monthly meeting is held to review cybersecurity measures and discuss any suspicious activities or vulnerabilities.
    2. As part of the recruiting process, basic cybersecurity knowledge is required, ensuring that new employees are equipped to follow security protocols effectively.

Access control

Access by authorised persons shall be limited to the personal data they need to perform their task. The Processor shall implement the following access control measures:

  1. Differentiated authorisations according to a defined authorisation concept
  2. Profiles, roles, transactions and objects for evaluations, knowledge, modification, deletion
  3. No uncontrolled access to personal data by open user groups Logging of access to particularly sensitive data (read, change, delete) Separation of system files and user files
  4. Separation of system files of different applications
  5. Separation of user files of different users
  6. Virus protection programmes with automated regular updates Encryption of locally stored data
  7. Targeted, regular control of authorised devices in the system

Transfer control

It has to be possible to review facilities used for data transfers and determine in which parts personal data is transferred or provided. Data recipients to whom personal data are disclosed via data transfer (e.g. by remote access) must be identifiable. The measures are defined in 3.8 "Transport control".

Input control

In automated systems, it must be possible to subsequently check which personal data were entered at what time and by which person (log data). The following measure is taken by the processor in the context of access control:

  1. Entries of personal data can be traced, the detailed circumstances (time and context), the person entering the data and the respective basis of the entry are logged.

Transport control

During the disclosure of personal data as well as during the transport of data carriers, it must be prevented that data are read, copied, changed or deleted without authorisation. The Processor shall implement the following access control measures:

  1. Implementing regulations exist for the transfer of personal data (e.g. transport routes, means, times, containers, mode of dispatch)
  2. Data delivery and data reception are exclusively logged (identity of the sender/recipient, time, content and scope of the transfer)
  3. The data transfer takes place in encrypted form
  4. There are implementation rules for the archiving of the data carriers (media) used for the transfer
  5. The data carriers (media) used for the transfer will be deleted/destroyed after completion of the transfer in accordance with data protection regulations
  6. Data carriers and documents are always kept under lock and key; access is only possible for a dedicated group of authorised persons
  7. Before data media are reused or disposed of, they are always completely (physically) erased in accordance with the respective state of the art. Printouts and files or parts of files are disposed of in a data protection-compliant and appropriate manner as soon as their intended use is no longer given.

Recovery control

Depending on the need for protection, it must be ensured that deployed systems can be recovered in the event of a malfunction. The Processor shall implement the following measures as part of access control:

  1. A data protection concept is available for personal data, for the application programmes for their processing as well as for the correspondingly required system environment.
  2. Only high quality data carriers are used for data backup
  3. Restoring individual files is possible without much effort, and the availability of backup data and a suitable infrastructure (readers and software) is ensured.
  4. The data carriers for data backup are kept under lock and key and are only accessible to the system administrators entrusted with this task

Performance control

It must be ensured that, depending on the protection requirements, all functions of the system are available (availability, resilience), any malfunctions that occur are reported (reliability) and stored personal data cannot be damaged or disclosed by malfunctions of the system (integrity, confidentiality). The Processor shall implement the following access control measures:

  1. Log data is protected against manipulation
  2. Log data is deleted as soon as it is no longer required
  3. There is a list of the IT equipment used as well as dedicated documentation of the hardware including the network connection
  4. A register of the processing activities used is available
  5. Work instructions are available in writing and are known (trained) to all employees involved in processing
  6. Employees are trained on their obligations to cooperate under data protection law. The training is documented
  7. Certifications or audits are carried out by independent or internal bodies. Privacy-related responsibilities and oversight are assigned to the management of Interactive Paper GmbH (Managing Director: Tobias Macke). The need for a formal Data Protection Officer pursuant to Art. 37 GDPR is assessed annually; as of the current review date, no mandatory DPO appointment is required.
  8. A data breach notification concept is in place
  9. Employees were informed in a documented manner about reporting channels and emergency plans in the event of data protection violations
  10. It is ensured that the Controller is informed about data protection breaches
  11. Measures are established to ensure that the principle of data minimisation and purpose limitation are observed when processing personal data
  12. It is ensured that default settings limit the processing of personal data to what is necessary for the purpose of processing
  13. The execution of the order is ensured by internal control measures with regard to the qualitative, quantitative and temporal requirements of the order
  14. The processing of personal data by Sub-processors is carried out on the basis of processing agreements pursuant to Art 28 GDPR

Data Breach Detection and Monitoring

Measures shall be taken for the timely detection and traceability of (i) unauthorised access or disclosure of personal data and (ii) any event that may lead to a personal data breach. The Processor shall implement the following access control measures:

  1. Detection of data breaches and unauthorised access is done through warnings from the management software
  2. Ongoing monitoring of access authorisations
  3. Implementation of 2-factor authentication when accessing data
    1. As part of the control of compliance with the above data protection requirements, the implementation of and compliance with the technical organisational measures may be audited by the Controller or a third party appointed by him. The Controller reserves the right to determine the audit interval and the audit depth. Due to data protection incidents on the one hand, or proof of compliance with data protection and data security requirements, such as data protection-specific certification procedures approved by the supervisory authority as well as data protection seals and seals of approval on the other hand, the audit interval and the audit depth may be narrower or wider.
    2. As a result, the Processor must provide sufficient guarantees that appropriate technical organisational measures are implemented in such a way that all data protection and data security requirements are met, thereby ensuring an adequate level of protection for the rights of the data subject.

Questions about this document? Contact us at [email protected].