Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Contains contact information of DC's and DP's Data Protection Officers (DPO).

Example:

Contact information of the DPO <GÉANT's DPO name> of the Data controller.

GÉANT Vereniging (Association) Hoekenrode 3, 1102BR Amsterdam, The Netherlands

DPO (24x7) <GÉANT's DPO 24x7contact number>

GDPR@geant.org


Contact information of the data protection officer of the Data processor.

<Data processor's DPO contact information (address, phone, email…)>

Annex 2 - list of personal data

Contains list of all personal data which will be processed and categories of Data subjects involved.

Example:

Personal data that will be processed for the purposes of providing technical support for the Service and solving technical problems.

  1. Given Name
  2. Middle Name
  3. Family Name
  4. Email
  5. Telephone number
  6. Postal addresses
  7. IP address
  8. Affiliation

Categories of data subjects: individuals from Research & Academia community using the Service.

Annex 3 - specific security measures

Besides general security measures defined in main part of DPA, specific security measures which should be applied by DP in order to ensure protection of personal data can be defined. When properly implemented they can provide assurance that DP can provide adequate protection of rights of data subjects. These security measures are service specific and depends on architecture, scope and other factors and those are chosen based on risk assessment. Here is list of some types of security measures . Risk assessment can be used to decide which measures should be implemented.

The following table shows some security measures, grouped be categories, which can be used as reminder. Chosen measures should can be elaborated in more details as appropriate.

  1. organization - appropriate security policy
  2. personnel - trained in data security; signed AUP or Statement of Confidentiality concerning personal data
  3. access management - strong password or 2-factor authentication are used for authorization; access to data and data modifications are logged
  4. access protection - firewall or ACL protection
  5. stored data protection - pseudonymisation; anonymisation; database encryption; hard disk and removable media encryption; other forms of data encryption
  6. data transfer protection - during transfer data are protected with secure versions of encryption methods such as TLS, VPN, SSH, secured wireless...
  7. vulnerability management - software are timely patched; regular vulnerability scanning or penetration testing of applications or systems
  8. malware protection - end-station malware protection; email malware protection; education of personnel
  9. data leak protection - IDS; continuous monitoring; removable media policy
  10. regular backups - stored on safe place; encrypted; restore regularly checked
  11. incident management - incident response; timely reporting all incident to data controller
  12. (D)DOS protection - on network, system or application level

Aim of applying security measures is to ensure Confidentiality, Integrity and Availability (CIA) of personal data. The following table shows in more details which principle of CIA is improved by each class of security measures. Also, it in DPA, as appropriate. Table shows applicability of each security measure to different parts of data processor: organizational, system administration, network administration and application development. Which security measures and to which extend will be implemented is usually based on risk assessment. Table also shows which principle of Confidentiality, Integrity and Availability (CIA) of personal data is improved by each category of security measures.

CIA

Class of security

measures

Security measure

Category with security measures

OrganizationSystem
admin.
Network
admin.
Applications
development
security policy
CIA
Security policy


achieved level n of GÉANT Security Baseline






appropriate security policy






Personnel management


personnel
trained in (personal) data security






signed AUP or Statement of Confidentiality for (personal) data






Access management


role based access management






strong password or 2 factor authentication






logging of data modification
access







Access protection


network level (firewall, ACL, …
stored
)






server level






application or database level






Stored data protection


pseudonymisation






anonymisation






database encryption






hard disk and removable media encryption






other forms of data encryption
data transfer







Data transfered protection


secure transport (IPsec, VPN, wireless, …)






secure remote system access (TLS, RDP, SSH, …)






secure remote application or database access (TLS, SSH, …)
vulnerability







Vulnerability management


timely patching






regular vulnerability scanning of applications or systems






regular penetration testing of applications and systems

malware







Malware protection


end-station malware protection






email malware protection






education of personnel
data







Data leak protection


IDS/IPS






SIEM or continuous monitoring






removable media policy






personnel education
regular backups







Backups


backup policy ensure regular backups






stored on safe place






backed up data are encrypted






restore is regularly checked
incident







Incident management


incident response procedure






timely reporting all incident to data controller






(D)DOS protection


on network

, system or

level








on system level






on application level






Annex 4 - data transfers outside EU

Description of personal data transfers outside EU during processing.

Example:

Transfers to countries outside the European Economic Area without a suitable level of protection for which the Data controller has granted its authorisation:

Not applicable.

DPA approval procedure

 Process of drafting, approving and signing of DPA is shown on the following figure.

...