text: Low Risk Medium Risk High Risk

identifier: Handbook on Security of Personal Data Processing

title: Handbook on Security of Personal Data Processing

text: Handbook on Security of Personal Data Processing DECEMBER 2017 www.enisa.europa.eu European Union Agency For Network and Information Security

text: Handbook on Security of Personal Data Processing

text: December 2017

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Contact For queries in relation to this paper, please use isdp@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2017 Reproduction is authorised provided the source is acknowledged. ISBN 978-92-9204-251-6, DOI 10.2824/569768 02 Handbook on Security of Personal Data Processing

text: December 2017

text: Table of Contents

text: Executive Summary 6 1. Introduction 8 Background 8 Scope and Objectives 9 Methodology 9 Structure 9 2. Risk assessment and security measures for personal data 10 Methodological steps overview 10 2.1.1 Step 1: Definition of the processing operation and its context 10 2.1.2 Step 2: Understanding and evaluating impact 10 2.1.3 Step 3: Definition of possible threats and evaluation of their likelihood 12 2.1.4 Step 4: Evaluation of risk 15 2.1.5 Step 5: Security measures 16 Use cases and approach of the report 16 3. Use Cases: Human Resource Processes 18 Payroll management 18 3.1.1 Definition of the processing operation and its context 18 3.1.2 Evaluating Impact 18 3.1.3 Threat Occurrence Probability 19 3.1.4 Evaluation of Risk and Adoption of Security Measures. 20 Recruitment 20 3.2.1 Definition of the processing operation and its context 21 3.2.2 Evaluating Impact 21 3.2.3 Threat Occurrence Probability 22 3.2.4 Evaluation of Risk 22 Evaluation of employees 23 3.3.1 Definition of the processing operation and its context 23 3.3.2 Evaluating Impact 23 3.3.3 Threat Occurrence Probability 24 3.3.4 Evaluation of Risk 25 4. Use cases: Customers management, marketing and suppliers 26 Order and delivery of goods 26 4.1.1 Definition of the processing operation and its context 26 4.1.2 Evaluating Impact 26 4.1.3 Threat Occurrence Probability 27 03 Handbook on Security of Personal Data Processing

text: December 2017

text: Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case: 27 4.1.4 Evaluation of Risk 28 Marketing/advertising 28 4.2.1 Definition of the processing operation and its context 28 4.2.2 Evaluating Impact 29 4.2.3 Threat Occurrence Probability 29 4.2.4 Evaluation of Risk 30 Suppliers of services and goods 30 4.3.1 Definition of the processing operation and its context 31 4.3.2 Evaluating Impact 31 4.3.3 Threat Occurrence Probability 32 4.3.4 Evaluation of Risk 32 5. Safety and security 34 Access control 34 5.1.1 Evaluating Impact 34 5.1.2 Threat Occurrence Probability 35 5.1.3 Evaluation of Risk 35 Closed Circuit Television System (CCTV) 36 5.2.1 Definition of the processing operation and its context 36 5.2.2 Evaluating Impact 37 5.2.3 Threat Occurrence Probability 37 5.2.4 Evaluation of Risk 38 6. Specific use case: Health sector 39 Health Services Provision 39 6.1.1 Definition of the processing operation and its context 39 6.1.2 Evaluating Impact 39 6.1.3 Threat Occurrence Probability 40 6.1.4 Evaluation of Risk 41 Medically Assisted Procreation 41 6.2.1 Definition of the processing operation and its context 41 6.2.2 Evaluating Impact 42 6.2.3 Threat Occurrence Probability 42 6.2.4 Evaluation of Risk 43 Remote monitoring of patients with chronic diseases 43 6.3.1 Definition of the processing operation and its context 44 6.3.2 Evaluating Impact 44 6.3.3 Threat Occurrence Probability 44 6.3.4 Evaluation of Risk 45 7. Specific use case: Education sector 46 Early childhood – Crèche 46 04 Handbook on Security of Personal Data Processing

text: December 2017

text: 7.1.1 Definition of the processing operation and its context 46 7.1.2 Evaluating Impact 46 7.1.3 Threat Occurrence Probability 47 7.1.4 Evaluation of Risk 48 University e-learning platform 48 7.2.1 Definition of the processing operation and its context 49 7.2.2 Evaluating Impact 49 7.2.3 Threat Occurrence Probability 50 7.2.4 Evaluation of Risk 50 8. Conclusions 52 Annex A: Organizational and Technical Measures 55 Proposed Measures for Low Risk Level 55 Proposed Measures for Medium Risk Level 60 Proposed Measures for High Risk Level 64 05 Handbook on Security of Personal Data Processing

text: December 2017

text: Executive Summary

text: The General Data Protection

text: Regulation (EU) 679/2016

text: (‘GDPR’) will be, as of 25 May 2018, the main data protection legal framework in EU directly applicable to all Member States, repealing the current Data Protection Directive

text: . Currently, businesses in the EU have to deal with 28 different data protection laws. This fragmentation is a costly administrative burden that makes it harder for many companies, particularly SMEs, to access new markets. One of the core obligations for all businesses, including SMEs, acting either as data controllers or data processors, in GDPR is that of the security of personal data. In particular, according to GDPR security equally covers confidentiality, integrity and availability and should be considered following a risk-based approach: the higher the risk, the more rigorous the measures that the controller or the processor needs to take (in order to manage the risk). Even if this risk-based approach is not a new concept only a few specific privacy risk assessment frameworks have been presented, focusing principally on the evaluation of risks to personal data and adoption of relevant security measures. On this basis and as part of its continuous support on EU policy implementation, ENISA published in 2016 a set of guidelines for SMEs , acting as data controllers or processors, which aim at helping them assess security risks and accordingly adopt security measures for the protection of personal data. Those guidelines can also be of use in all cases where risk assessment is envisaged under the Regulation (e.g. Data Protection Impact Assessment, personal data breach notification, etc). Within 2017 the Agency continued its activities in the area and focused on providing further guidance on the application of the aforementioned guidelines through specific uses cases. In close collaboration with experts from national Data Protection Authorities, each use case corresponds to a specific personal data processing operation and makes specific assumptions on the data processing environment and overall context of processing. The provided examples however focus only on security measures and do not aim at providing any legal analysis or assessment of compliance with GDPR for the specific data processing operations. While performing the analysis, a number of conclusions and relevant recommendations, targeted at different stakeholders, were drawn and are presented below.  Competent EU bodies, EU policy makers and regulators (e.g. Data Protection Authorities) should develop practical and scalable guidelines that will be able to support and assist different types of data controllers and address specific stakeholders’ communities.  Competent EU bodies, EU policy makers and regulators (e.g. Data Protection Authorities) should promulgate a set of baseline professional skills and requirements that Data Protection Officers’ should meet.  EU policy makers and regulators (e.g. Data Protection Authorities) should define and promote scalable data protection certification schemes, that meet the needs of SMEs and empower them to achieve and demonstrate compliance.  The research community and competent EU bodies, in close collaboration with regulators (e.g. Data Protection Authorities), should propose and put forward methodologies that combine security risk management and risk management of personal data. 06 Handbook on Security of Personal Data Processing

text: December 2017

text:  SME communities and associations, in close collaboration with competent EU bodies and regulators (e.g. Data Protection Authorities), should communicate and encourage data controllers to undertake actions towards security and privacy compliance as a competitive advantage alongside the underlying legal obligations. 07 Handbook on Security of Personal Data Processing

text: December 2017

text: 1. Introduction

text: Background The General Data Protection

text: Regulation (EU) 679/2016

text: . Under the Regulation, one of the core obligations for all businesses, acting either as data controllers or data processors, is that of the security of personal data processing. Although security of personal data has already been a legal obligation for data controllers under the Data Protection Directive, GDPR reinforces the relevant provisions (both in substance and context), extending at the same time this responsibility directly also to data processors. In particular, the security of personal data processing is mainly mandated in Article 32 of GDPR, which states that: ‘Having regard to the state of the art and the costs of implementation and taking into account the nature, scope, context and purposes of the processing as well as the risk of varying likelihood and severity for the rights and freedoms of individuals, the controller and the processor shall implement appropriate technical and organisational measures, to ensure a level of security appropriate to the risk, including inter alia, as appropriate: (a) the pseudonymisation and encryption of personal data; (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services processing personal data; (c) the ability to restore the availability and access to data in a timely manner in the event of a physical or technical incident; (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.’ The article further stipulates that ‘in assessing the appropriate level of security account shall be taken in particular of the risks that are presented by data processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed’. It also mentions that adherence to an approved code of conduct (

text: Article 40

text: GDPR) or an approved certification mechanism (

text: Article 41

text: GDPR) may be used as an element to demonstrate compliance with the requirements for the security of processing. Last, it states that the controller and processor ‘shall take steps to ensure that any person acting under their authority and having access to personal data, shall not process them except on instructions from the controller, unless otherwise required by Union or member state law’. According to the aforementioned provisions, in GDPR security equally covers confidentiality, integrity and availability and should be considered following a risk-based approach: the higher the risk (for the rights and freedoms of data subjects), the more rigorous the measures that the controller or the processor needs to take (in order to manage the risk). Moreover, security of processing should be regarded within the overall GDPR accountability framework for data protection, which is also risk-based and impact-based and aims to fit into the specific operational context and practices of an organization. http://eur-lex.europa.eu/eli/reg/2016/679/oj http://eur-lex.europa.eu/eli/dir/1995/46/oj 08 Handbook on Security of Personal Data Processing

text: December 2017

text: Taking the above considerations into account, ENISA published in 2016 a set of guidelines for SMEs , acting as data controllers or processors, which aim at helping them assess security risks and accordingly adopt security measures for the protection of personal data. Under its 2017 work-programme, ENISA decided to continue this work by providing practical examples on the application of the guidelines by SMEs. Scope and Objectives The overall scope of the present report is to provide practical demonstrations and interpretation of the methodological steps of the ENISA’s 2016 guidelines for SMEs on the security of personal data processing. This is performed through specific use cases and pragmatic processing operations that are common for all SMEs. For each use case, the ENISA’s guidelines are applied in order to assess in practice the risk (for the rights and freedoms of data subjects) and adopt the technical and organisational measures that are appropriate to the risk presented. The target audience of the report is mainly SMEs, acting as data controllers or processors, that can use the examples as an inspiration for their own assessment of risks and adoption of security measures, while pursuing compliance with GDPR. Data Protection Authorities (DPAs) might also find the use cases of interest in the context of their own data protection audit frameworks and security recommendations. It should be noted that, although all types of data processing systems are covered by ENISA’s 2016 guidelines, this report is mainly focused on electronic personal data processing by SMEs, which is based on IT networks and systems, as well as new digital technologies (e.g. cloud computing, mobile devices, etc.). The report focuses explicitly on security measures and does not aim at making any legal analysis or assessment of compliance of specific data processing operations. Methodology The report was supported by an expert group, comprising of Georgia Panagopoulou (Hellenic Data Protection Authority) and Giuseppe D'Acquisto (Italian Data Protection Authority). A number of processing operations was identified as the most typical ones or the ones that are met more often for the majority of SMEs and was then validated, to the extent possible, with relevant data controllers. Structure The structure of the document is as follows:  Chapter 2 provides an overview of the methodological steps on the evaluation of security risks by SMEs, as already proposed in 2016.  Chapters 3 to 7 present the selected use cases, with an analysis of the each processing operation and calculation of the overall level of risk, based on the methodological steps described earlier.  Chapter 8 draws a number of final observations and conclusions with regard to the implementation of the proposed approach by SMEs. The report complements previous ENISA’s work in the fields of privacy and security of personal data . https://www.enisa.europa.eu/publications/guidelines-for-smes-on-the-security-of-personal-data-processing For more information, see: https://www.enisa.europa.eu/topics/data-protection 09 Handbook on Security of Personal Data Processing

text: December 2017

text: 2. Risk assessment and security measures for personal data

text: ENISA, in its 2016 guidelines , presented a simplified approach that can guide the SMEs (acting as data controllers or processors) through their specific data processing operation, supporting them in evaluating the relevant security risks and accordingly adopting security measures. In this chapter we provide a short overview of ENISA’s 2016 guidelines that will be used in the rest of the report for providing practical examples. We also introduce the notion of ‘use cases’ upon which the examples on data processing scenarios will be built. Methodological steps overview The ENISA’s guidelines for SMEs propose an approach on evaluation of risk, which is based on four steps, as follows:  Definition of the processing operation and its context.  Understanding and evaluation of impact.  Definition of possible threats and evaluation of their likelihood (threat occurrence probability).  Evaluation of risk (combining threat occurrence probability and impact). Following the evaluation of risk, the SMEs can adopt technical and organizational security measures (from a proposed list) that are appropriate to the level of risk. 2.1.1 Step 1: Definition of the processing operation and its context This step is the starting point of the risk assessment and is fundamental for the data controller in order to define the boundaries of the data processing system (under assessment) and its relevant context. To support SMEs in defining the processing operation a set of questions is provided. 1. What is the personal data processing operation? 2. What are the types of personal data processed? 3. What is the purpose of the processing? 4. What are the means used for the processing of personal data? 5. Where does the processing of personal data take place? 6. Which are the categories of data subjects? 7. Which are the recipients of the data? While answering these questions, an SME needs to consider the various phases of the data processing (collection, storage, use, transfer, disposal, etc.) and their subsequent parameters. 2.1.2 Step 2: Understanding and evaluating impact Based on the analysis of Step 1, the data controller at this stage must assess the impact on the fundamental rights and freedoms of the individuals, resulting from the possible loss of security of the https://www.enisa.europa.eu/publications/guidelines-for-smes-on-the-security-of-personal-data-processing Handbook on Security of Personal Data Processing

text: December 2017

text: personal data. Four levels of impact are considered (Low, Medium, High, Very High) as shown in Table 1 below.

text: LEVEL OF IMPACT DESCRIPTION

text: Individuals may encounter a few minor inconveniences, which they will overcome without any Low problem (time spent re-entering information, annoyances, irritations, etc.). Individuals may encounter significant inconveniences, which they will be able to overcome Medium despite a few difficulties (extra costs, denial of access to business services, fear, lack of understanding, stress, minor physical ailments, etc.). Individuals may encounter significant consequences, which they should be able to overcome High albeit with serious difficulties (misappropriation of funds, blacklisting by financial institutions, property damage, loss of employment, subpoena, worsening of health, etc.). Individuals which may encounter significant, or even irreversible consequences, which they Very high may not overcome (inability to work, long-term psychological or physical ailments, death, etc.).

text: Table 1: Levels of impact description

text: The evaluation of impact is a qualitative process and a number of factors need to be considered by the data controller, such as the types of personal data, criticality of the processing operation, volume of personal data, special characteristics of the data controller, as well as special categories of data subjects. In order to support the controller in this process, Table 2 can be used to assess separately impact from loss of confidentiality, integrity and availability. After this assessment, three different levels of impact (for loss of confidentiality, integrity and availability) will be obtained. The highest of these levels is considered as the final result of the evaluation of the impact, relating to the overall processing of personal data.

text: NO QUESTION EVALUATION

text: Low

text: Please reflect on the impact that an unauthorized disclosure (loss of

text: Medium I.1. confidentiality) of personal data - in the context where your business activity takes place - could have on the individual and express a rating accordingly. High

text: Very high

text: Low

text: Please reflect on the impact that an unauthorized alteration (loss of integrity) of

text: Medium I.2. personal data - in the context where your business activity takes place - could have on the individual and express a rating accordingly. High

text: Very high

text: Low

text: Please reflect on the impact that an unauthorized destruction or loss (loss of

text: I.3. availability) of personal data - in the context where your business activity takes Medium

text: place - could have on the individual and express a rating accordingly.

text: High Very high

text: December 2017

text: Table 2: Impact evaluation questions

text: 2.1.3 Step 3: Definition of possible threats and evaluation of their likelihood At this step, the scope for the data controller is to understand the threats related to the overall environment of the personal data processing (external or internal) and assess their likelihood (threat occurrence probability). To simplify this process, a number of assessment questions have been defined, which aim at making the SMEs aware of the data processing environment (that is directly relevant to the threats). As such, they relate to four main dimensions of this environment (assessment areas), namely:  Network and technical resources (hardware and software)  Processes/procedures related to the data processing operation  Different parties and people involved in the processing operation  Business sector and scale of the processing Table 3 below summarizes the questions related to the assessment of threat occurrence probability. A. NETWORK AND TECHNICAL RESOURCES

text: When the processing of personal data is performed fully or partially through the open Internet, possible Is any part of the processing of personal data performed threats from external online attackers increase (e.g. 1. through the internet? Denial of Service, SQL injection, Man-in-the-Middle attacks), especially when the service is available (and, thus, traceable/known) to all internet users.

text: When access to an internal data processing system is provided through the internet, the likelihood of external threats increases (e.g. due to external online attackers). At the same time the likelihood of

text: Is it possible to provide access to an internal personal data

text: (accidental or intentional) misuse of data by the users 2. processing system through the internet (e.g. for certain users or also increases (e.g. accidental disclosure of personal

text: groups of users)?

text: data when working in public spaces). Special attention should be given to cases where remote management/administration of the IT system is allowed.

text: Connection to external IT systems may introduce additional threats due to the threats (and potential security flaws) that are inherent to those systems. The

text: Is the personal data processing system interconnected to

text: same applies also to internal systems, taking into 3. another external or internal (to your organization) IT system or account that, if not appropriately configured, such

text: service?

text: connections may allow access (to the personal data) to more persons within the organization (which are not in principle authorized for such access).

text: Although focus has been put on electronic systems and services, the physical environment (relevant to these Can unauthorized individuals easily access the data processing systems and services) is an important aspect that, if not 4.

text: environment?

text: adequately safeguarded, can seriously compromise security (e.g. by allowing unauthorized parties to gain physical access to the IT equipment and network

text: December 2017

text: components or failing to provide protection of the computer room in the event of a physical disaster).

text: Poorly designed, implemented and/or maintained Is the personal data processing system designed, implemented hardware and software components can pose serious or maintained without following relevant best practices? risks to information security. To this end, good or best 5. practices accumulate the experience of prior events and can be regarded as practical guidelines of how to avoid exposure and achieve certain levels of resilience.

text: B. PROCESSES/PROCEDURES RELATED TO THE PROCESSING OF PERSONAL DATA

text: When roles and responsibilities are not clearly defined, access (and further processing) of personal data may

text: Are the roles and responsibilities with regard to personal data

text: 6. be uncontrolled, resulting to unauthorized use of

text: processing vague or not clearly defined?

text: resources and compromising the overall security of the system.

text: When acceptable use of resources is not clearly Is the acceptable use of the network, system and physical mandated, security threats might arise due to 7. resources within the organization ambiguous or not clearly misunderstanding or intentional misuse of the system. defined The clear definition of policies for network, system and physical resources can reduce potential risks.

text: Employees using their personal devices within the organization could increase the risk of data leakage or Are the employees allowed to bring and use their own devices unauthorized access to the information system. 8. to connect to the personal data processing system? Moreover, as devices are not centrally controlled, they may introduce additional bugs or viruses into the system.

text: Processing of personal data outside the premises of the organization can offer a lot of flexibility, but at the Are employees allowed to transfer, store or otherwise process same time introduces additional risks, both related to 9. personal data outside the premises of the organization? the transmission of information through possibly insecure network channels (e.g. open Wi-Fi networks), as well as unauthorised use of this information.

text: The lack of appropriate logging and monitoring Can personal data processing activities be carried out without mechanisms can increase intentional or accidental 10. log files being created? abuse of processes/procedures and resources, resulting to the subsequent abuse of personal data.

text: C. PARTIES/PEOPLE INVOLVED IN THE PROCESSING OF PERSONAL DATA

text: When access (and further processing) of personal data is open to a large number of employees, the Is the processing of personal data performed by a non-defined possibilities of abuse due to human factor increase. 11. number of employees? Clearly defining who really needs to access the data and limiting access only to those persons can contribute to the security of personal data.

text: When the processing is performed by external Is any part of the data processing operation performed by a contractors, the organization may lose partially the 12. control over these data. Moreover, additional security

text: contractor/third party (data processor)?

text: threats may be introduced due to the threats that are inherent to these contractors. It is important for the

text: December 2017

text: organization to select contractors that can offer a high level of security and to clearly define what part of the processing is assigned to them, maintaining as much as possible a high level of control.

text: When employees are not clearly informed about their obligations, threats from accidental misuse (e.g. Are the obligations of the parties/persons involved in personal disclosure or destruction) of data many significantly 13. data processing ambiguous or not clearly stated? increase.

text: When employees are not aware of the need of applying security measures, they can accidentally pose Is personnel involved in the processing of personal data further threats to the system. Training can greatly 14. unfamiliar with information security matters? contribute to making employees aware both of their data protection obligations, as well as the application of specific security measures.

text: Many personal data breaches occur due to the lack of physical protection measures, such as locks and secure Do persons/parties involved in the data processing operation destruction systems. Paper based files are usually part 15. neglect to securely store and/or destroy personal data? of the input or the output of an information system, can contain personal data and should also be protected from unauthorized disclosure and re-use.

text: D. BUSINESS SECTOR AND SCALE OF PROCESSING

text: When security attacks have already taken place in a Do you consider your business sector as being prone to specific business sector, there is an indication that the 16. cyberattacks? organization would probably need to take additional measures to avoid a similar event.

text: If the organization has already been attacked or there Has your organization suffered any cyberattack or other type of are indications that this might have been the case, 17. security breach over the last two years? additional measures need to be taken to prevent similar events in the future.

text: Security bugs/vulnerabilities can be exploited to perform attacks (cyber or physical) to systems and

text: Have you received any notifications and/or complaints with

text: services. Security bulletins containing important 18. regard to the security of the IT system (used for the processing information regarding security vulnerabilities that

text: of personal data) over the last year?

text: could affect the aforementioned systems and services should be considered.

text: The type and volume of personal data (scale) can make

text: Does a processing operation concern a large volume of

text: 19. the processing operation attractive to attackers (due

text: individuals and/or personal data?

text: to the inherent value of these data).

text: Sector specific security measures are usually adjusted Are there any security best practices specific to your business to the needs (and risks) of the particular sector. Lack of 20. sector that have not been adequately followed? compliance with relevant best practices might be an indicator of poor security management.

text: Following this approach, the level of threat occurrence probability can be defined for each of the assessment areas, as follows: Handbook on Security of Personal Data Processing

text: December 2017

text:  Low: the threat is unlikely to materialize.  Medium: there is a reasonable chance that the threat materializes.  High: the threat is likely to materialize Tables 4 and 5 can then be used to document the threat occurrence probability for each assessment area and accordingly calculate its final value.

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Low 1 NETWORK AND TECHNICAL RESOURCES Medium 2 High 3

text: Low 1

text: PROCESSES/PROCEDURES RELATED TO THE PROCESSING OF

text: Medium 2

text: PERSONAL DATA

text: High 3

text: Low 1

text: PARTIES/PEOPLE INVOLVED IN THE PROCESSING OF PERSONAL

text: Medium 2

text: DATA

text: High 3

text: Low 1 BUSINESS SECTOR AND SCALE OF PROCESSING Medium 2 High 3

text: Table 3: Assessing threat occurrence probability per area

text: OVERALL SUM OF THREAT OCCURRENCE THREAT OCCURRENCE PROBABILITY LEVEL PROBABILITY

text: 4 - 5 Low 6 - 8 Medium 9 -12 High

text: Table 4: Evaluation of threat occurrence

text: The final threat occurrence probability is calculated after summing up the four different scores obtained under Table 4 and associating the result to the scales of Table 5. 2.1.4 Step 4: Evaluation of risk After evaluating the impact of the personal data processing operation and the relevant threat occurrence probability, the final evaluation of risk is possible (Table 6). Handbook on Security of Personal Data Processing

text: December 2017

text: IMPACT LEVEL

text: Low Medium High / Very High Low

text: THREAT OCCURRENCE

text: PROBABILITY Medium High

text: Table 6: Evaluation of risk

text: Irrespective of the final result of this exercise, the SME should feel free to adjust the obtained risk level, taking into account specific characteristics of the data processing operation (that have been missed during the assessment process) and providing adequate justification for this adjustment. 2.1.5 Step 5: Security measures Following the evaluation of the risk level, the SME can proceed with the selection of appropriate security measures for the protection of personal data. The ENISA guidelines consider two broad categories of measures (organizational and technical ones), which are further divided in specific subcategories. Under each subcategory measures are presented per risk level (low: green, medium: yellow, high: red). In order to achieve scalability, it is assumed that all measures described under the low level (green) are applicable to all levels. Similarly, measures presented under the medium level (yellow) are applicable also to high level of risk. Measures presented under the high level (red) are not applicable to any other level of risk. Annex A: presents the list of proposed measures per risk level. It should be noted that the matching of measures to specific risk levels should not be perceived as absolute. Depending on the context of the personal data processing, the organization can consider adopting additional measures, even if they are assigned to a higher level of risk. Furthermore, the proposed list of measures does not take into account other additional sector specific security requirements, as well as specific regulatory obligations, arising for example from the ePrivacy Directive or the NIS Directive . In an attempt to further facilitate this procedure a mapping of the proposed group of measures with the ISO/IEC 27001:2013 security controls is also included. Use cases and approach of the report As already mentioned, this report provides further guidance on the application of ENISA’s guidelines (section 2.1) based on use case scenarios (‘use cases’). Each use case corresponds to a specific personal Directive

text: on privacy and electronic communications: http://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=celex%3A32002L0058 Directive 2016/1148 concerning measures for a high common level of security of network and information systems across the Union http://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1481193515962&uri=CELEX:32016L1148 ISO/IEC 27001:2013 - Information technology -- Security techniques -- Information security management systems – Requirements http://www.iso.org/iso/catalogue_detail?csnumber=54534 Handbook on Security of Personal Data Processing

text: December 2017

text: data processing operation and makes specific assumptions on the data processing environment and overall context of processing. To this end, within the context of EU SMEs, a number of processing operations have been identified. These processing operations vary from Human Resources (HR) related processes, provision of goods, marketing and physical security/access control. In addition to these general categories, some specific use cases from the health and education sectors are considered. For each use case, a description of the processing operation is provided, depicting the assumptions that were made and the specificities that were taken into account. Then the evaluation of risk is performed, on the basis of the assumptions made within the description and throughout the various steps. Specific parameters that could alter the overall risk are also mentioned in certain cases. Following the risk evaluation, the appropriate (to the identified level of risk) security measures can be adopted based on Annex A:. The calculation of risk for each use case should only be seen as an example of the application of ENISA’s guidelines under the specific example scenario (and relevant assumptions made). It cannot be regarded as an a priori applicable to the related data processing operations. The data controller is advised to start with the examples provided and further carry out the assessment based on her specific data processing context and environment. The use cases focus only on security measures and do not aim at providing any legal analysis or assessment of compliance with GDPR for the specific data processing operations. To this end, any assumptions made under the use cases are only meant to facilitate the provision of practical examples and they do not provide any indication with regard to the legality/compliance of specific data processing operations. Handbook on Security of Personal Data Processing

text: December 2017

text: 3. Use Cases: Human Resource Processes

text: A typical SME will process personal data of its’ employees as part of the Human Resources (HR) activities. Depending on the nature of business activities, the size and the internal organization of an SME, the Human Recourses activities might pertain additional procedures, process more or less personal data or for different purposes. The most common processing operations that we consider in this report are: a) Payroll management, b) Leave - absence management, c) Recruitment and d) Evaluation of staff. Other operations could include Health data of staff (e.g. annual medical check-ups required by the employer, trainings of staff, etc. Payroll management Within the scope of this use case, we consider as an example a retail SME that processes personal data of its employees for salaries, benefits and social security. The personal data considered to be processed are: contact information (such as last and first name, address, telephone numbers,) social insurance number, taxation Identifier, date of employment, position and salary information. The processing operation is facilitated by the HR IT system, which is deployed within the premises of the SME, and the HR officer operates it. There is a specific use policy in place. However, there are no specific policies regarding data retention and destruction. Processing of personal data is limited to the premises of the company. Towards the end of each month, the HR officer submits to the financial Institutions and the social security institute statements for all employees. Although the HR officer has signed a confidentiality disclaimer, no security or data protection training has recently been performed for the SME’s employees. 3.1.1 Definition of the processing operation and its context The specific data processing operation can be detailed, as follows:

text: PROCESSING OPERATION EMPLOYEES PAYROLL MANAGEMENT DESCRIPTION

text: Contact information (last and first name, address, telephone number,) social security

text: Personal Data Processed

text: number, taxation Identifier, date of employment, salary information

text: Processing Purpose Payroll management (payment of salaries, benefits and social security contributions) Data Subject Employees Processing Means Human Resources IT System

text: External Financial Institutions

text: Recipients of the Data

text: External Social Insurance Schemes

text: Data Processor Used In-house (no data processor)

text: 3.1.2 Evaluating Impact Following the approach presented in section 2.1.2, the following analysis can be made: Loss of confidentiality Within the scope of the employees’ payroll management processing operation, as described above, the impact from loss of confidentiality is mainly related to potential unintended disclosure of income (and other relevant data) to third parties. This could expose the data subject to consequences ranging from the discomfort arising from the public knowledge of one’s own private data to even, in specific cases, the Handbook on Security of Personal Data Processing

text: December 2017

text: potential risk of targeted attacks from thefts or money seekers. This might be more than a simple annoyance, and the impact from loss of confidentiality could, thus, be set to MEDIUM. Loss of integrity and availability The loss of integrity and/or availability might be in general considered as LOW, as data subjects are expected to face inconvenience (e.g. need to resubmit information or unable to receive monthly payment on time) but the problems can be quickly overcome. More serious impacts from loss of confidentiality might be set to MEDIUM if the consequences to data subjects are more persistent over time (e.g. repeatedly delaying payments of salaries); this is however not considered to be the general case in our example. The next table summarizes the aforementioned analysis.

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: Medium Low Low

text: Overall Impact Evaluation MEDIUM

text: The overall result of the evaluation of the impact is the highest identified. Therefore, the overall impact in this particular case is evaluated as MEDIUM. Further to the assumptions made in this example, there might be cases where the overall impact could be higher from the one calculated above. An example of such case could be the:  systematic processing of specific health/disability data (e.g. due to special privileges/working arrangements, such as extra allowances for impaired or disadvantaged employees). In such case the data controller should consider whether the impact level is set to HIGH. 3.1.3 Threat Occurrence Probability Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case:  Network & technical resources: The threat occurrence probability is LOW, as the system is not connected to the internet and does not allow access from internet to internal resources and other IT systems. It is assumed for this use case that unauthorized access is prevented following relevant ICT security best practices.  Processes/Procedures related to the processing of personal data: The threat occurrence probability is LOW, assuming that roles and responsibilities of HR officer are clearly defined along to an acceptable use policy, processing of personal data is limited to the premises of the organization and log files are created for any processing activity.  Parties/People involved in the processing of personal data: The threat occurrence probability is MEDIUM as HR officers have not received relevant information security training and it is not certain that personal data are always securely processed and/or destroyed (due to lack of relevant policies – see use case description).  Business sector and scale of processing: The threat occurrence probability is LOW as the business sector of the SME is in general not considered prone to cyberattacks. It is assumed that no personal Handbook on Security of Personal Data Processing

text: December 2017

text: data breach is known to have occurred in the past and the processing operation is limited only to the employees of the SME.

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Network and Technical Resources Low 1 Processes/Procedures related to the processing of personal data Low 1 Parties/People involved in the processing of personal data Medium 2 Business sector and scale of processing Low 1

text: Overall Threat Occurrence Probability Low (5)

text: Following the aforementioned assessment, the overall threat occurrence probability is calculated as LOW. 3.1.4 Evaluation of Risk and Adoption of Security Measures. Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. IMPACT LEVEL Low Medium High / Very High Low X

text: THREAT OCCURRENCE

text: PROBABILITY Medium High

text: The overall risk for this particular case is generally considered as MEDIUM. Annex A: (A.1 and A.2) can be used for the adoption of measures appropriate to the risk presented. Note should be taken that the risk might be different (higher) under special conditions directly related to the specific data processing operation and affecting either the impact or the threat occurrence probability (see also relevant considerations under section 3.1.2). Recruitment Within the scope of this use case, we consider again the retail SME described in section 3.1. Staff recruitment is a process run by HR and consists of numerous organizational activities aimed at the selection of people who have specific skills or are capable of performing certain tasks. After the vacancy notice has been published, candidates are invited to submit their application electronically alongside a detailed curriculum, with the academic education and qualifications, working experience, further professional or academic training, family status, and personal details such as first and last name, address, telephone numbers, date of birth. The selection committee reviews and evaluates the applications and comes up with a list of candidates to be invited for an interview. During the interview, the selection committee members take notes on the performance of the candidate and at the end they draft a detailed report which is submitted to senior management. Processing is facilitated by an IT system which supports the submission of applications, the shortlisting of candidates and the interview reports and is operated by an HR officer. Handbook on Security of Personal Data Processing

text: December 2017

text: 3.2.1 Definition of the processing operation and its context

text: PROCESSING OPERATION RECRUITMENT DESCRIPTION

text: Academic education and qualifications, working experience, further professional or

text: Personal Data Processed academic training , family status, first and last name, address, telephone numbers,

text: date of birth, interview notes/report

text: Processing Purpose Managing candidate selection for recruitment Data Subject Recruitment Candidates Processing Means Recruitment IT platform Recipients of the Data Internal Senior Management Data Processor Used In-house (no data processor)

text: 3.2.2 Evaluating Impact Following the approach presented in section 2.1.2, the following analysis can be made: Loss of confidentiality Within the scope of the employees’ recruitment operation, as described above, the loss of confidentiality could allow disclosure of data of the candidates, potentially leading to embarrassment or defamation. This is mainly related to the evaluation results, that may provide an assessment of the candidate’s professional experience and capacity, as well as other personal qualities (e.g. ability to communicate well or express himself/herself clearly). For the purpose of this use case, we assume that the recruitment platform provides for a structured assessment of the candidates, based on specific professional criteria, and does not include other types of assessments of the personality or characteristics of the candidate (e.g. psychological profile). Following the aforementioned description, the data subject is expected to encounter from minor to serious inconvenience from loss of confidentiality, which could in some cases influence her ability of getting employed. Therefore, the impact level for this case could in general be considered as MEDIUM. Loss of integrity The level of impact resulting from loss of integrity is considered to be MEDIUM as unauthorized alteration of personal data processed could either hinder the successful accomplishment of the recruitment procedure or amend the eligibility/ interview report of a candidate (and, thus, her possibility of getting employed). Loss of availability The level of impact resulting from loss of integrity is considered to be LOW as data subjects are expected to encounter minor inconvenience, due to the delay of the process, which will not be invalidated though. The next table summarizes the aforementioned analysis.

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: Medium Medium Low

text: December 2017

text: Overall Impact Evaluation MEDIUM

text: The overall result of the evaluation of the impact is the highest identified and therefore the overall impact evaluated is MEDIUM. Further to the assumptions made in this example, there might be cases where the overall impact could be higher from the one calculated above. For example, such could be the case of an evaluation process including psychological tests or specific behavioural characteristics of the candidates. Another case could be if personal data related to disabilities, ethnic background etc. are also processed. 3.2.3 Threat Occurrence Probability Based on the questions, presented in Section 2.1.3, we the following assessment was made for each dimension of the processing operations’ environment:  Network & technical resources: The threat occurrence probability is LOW as the processing is not performed through the Internet and the evaluation platform is a dedicated system, which is not connected to other IT systems of the SME. Like in previous cases, it is assumed that best practices are deployed to prevent unauthorized access and accordingly safeguard the data.  Processes/Procedures related to the processing of personal data: The threat occurrence probability is LOW, assuming that roles and responsibilities of employees involved are clearly defined along to an acceptable use policy, processing of personal data is limited to the premises of the organization and log files are created for any processing activity.  Parties/People involved in the processing of personal data: The threat occurrence probability is MEDIUM as it includes a large number of employees involved in the processing (HR officers, selection committee, senior management) and it is assumed that not all employees involved in the processing have received relevant information security training.  Business sector and scale of processing: The threat occurrence probability is LOW as the business sector of the SME is in general not considered prone to cyberattacks and no personal data breach is known to have occurred in the past. The processing operation is limited only to the employees of the SME.

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Following the aforementioned assessment, the overall threat occurrence probability is calculated as LOW. 3.2.4 Evaluation of Risk Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. Handbook on Security of Personal Data Processing

text: December 2017

text: IMPACT LEVEL Low Medium High / Very High Low X

text: THREAT OCCURRENCE

text: PROBABILITY Medium High

text: In particular, the overall risk for this particular case is generally considered as MEDIUM. Annex A: (A.1 & A.2) can be used for the adoption of measures appropriate to the risk presented. Note should be taken that the risk might be different (higher) under conditions directly related to the specific data processing operation and affecting either the impact or the threat occurrence probability. For example, if the candidates have access to their evaluation reports directly through the recruitment IT platform, the threat occurrence probability would probably be increased to HIGH. See also relevant considerations under section 3.3.2 for impact evaluation. Evaluation of employees Within the scope of this use case, we consider as an example an SME specializing in IT products and relevant consultancy services. On a yearly basis, each employee is evaluated by the line manager against predefined and pre-agreed criteria related to his/her performance and professional characteristics, which include reliability, orientation towards users/customers, timeliness/readiness, interpersonal skills, flexibility, autonomy, written and oral communication skills and team spirit. The processing is performed by an HR officer and line managers with electronic tools and paper documentation. The line manager produces a first version of the report on paper and discusses the findings with the employee. The final version of the report is duly signed and submitted electronically to the HR department while the summary and the conclusions/findings of the report are submitted electronically as well. 3.3.1 Definition of the processing operation and its context

text: PROCESSING OPERATION EVALUATION OF STAFF DESCRIPTION

text: First and last name, position within the SME, date of employment, employment

text: Personal Data Processed history, technical skills, knowledge and behaviours (work performance evaluation

text: reports)

text: Assessment of the performance and professional characteristics that arise in the

text: Processing Purpose

text: execution of the work

text: Data Subject Employees Processing Means Human Resources IT System Recipients of the Data Internal Line Managers Data Processor Used In-house (no data processor)

text: 3.3.2 Evaluating Impact Following the approach presented in section 2.1.2, the following analysis can be made: Handbook on Security of Personal Data Processing

text: December 2017

text: Loss of confidentiality Within the scope of this processing operation, it should be taken into account that the staff assessment provides a detailed professional profile of the employee by attributing quantitative and qualitative values to her performance at work. Although evaluation may be limited to work performance, in the course of the exercise, other individual's characteristics may emerge, creating a marginal risk that information relating to the behavior and personality of the employees is also processed. The loss of confidentiality of this data could range from simple discomfort to dishonor or even limitation of the employee, e.g. when seeking for a new job. Therefore, the impact of loss of confidentiality is considered as MEDIUM. Loss of integrity The loss of integrity might be in general considered as MEDIUM as data subjects are expected to encounter significant inconveniences including improper evaluation or lack or delays in benefitting from the results of the evaluation. Loss of availability The loss of availability might be in general considered as LOW as data subjects are expected to encounter minor inconveniences due to the delay of the process, which will not be invalidated though. The next table summarizes the aforementioned analysis.

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: Medium Medium Low

text: Overall Impact Evaluation MEDIUM

text: The overall result of the evaluation of the impact is the highest identified and therefore the overall impact evaluated is MEDIUM. Further to the assumptions made in this example, there might be cases where the overall impact could be higher from the one calculated above. An example of such case could be when the:  Specific working context requires an assessment of the psychological characteristics of the employees or when sensitive data are included in the course of the evaluation process (e.g. relating to persons with disabilities). 3.3.3 Threat Occurrence Probability Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case:  Network & technical resources: The threat occurrence probability is LOW, as the system is not connected to the internet and does not allow access from internet to internal resources and other IT systems. It is assumed for this use case that unauthorized access is prevented based on relevant best practices.  Processes/Procedures related to the processing of personal data: The threat occurrence probability is MEDIUM, assuming that the use policy is not clearly defined and processing of information is not necessarily limited to the premises of the organization (paper based process). Handbook on Security of Personal Data Processing

text: December 2017

text:  Parties/People involved in the processing of personal data: The threat occurrence probability is MEDIUM as it is assumed (from the case description) that there no specific policies regarding secure storage and deletion of data (especially when part of the process is paper based).  Business sector and scale of processing: The threat occurrence probability is LOW as the business sector of the SME is in general not considered prone to cyberattacks and it is assumed that no personal data breach is known to have occurred in the past. The processing operation is limited only to the employees of the SME.

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Network and Technical Resources Low 1 Processes/Procedures related to the processing of personal data Medium 2 Parties/People involved in the processing of personal data Medium 2 Business sector and scale of processing Low 1

text: Overall Threat Occurrence Probability Medium (6)

text: Following the aforementioned assessment, the overall threat occurrence probability is calculated as MEDIUM. 3.3.4 Evaluation of Risk Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. IMPACT LEVEL Low Medium High / Very High Low

text: THREAT OCCURRENCE

text: PROBABILITY Medium X High

text: In particular, the overall risk for this particular case is generally considered as MEDIUM. Annex A: (A.1 & A.2) can be used for the adoption of measures appropriate to the risk presented. Note should be taken that the risk might be different (higher) under conditions directly related to the specific data processing operation and affecting either the impact or the threat occurrence probability (see also relevant considerations under section 3.3.2). Handbook on Security of Personal Data Processing

text: December 2017

text: 4. Use cases: Customers management, marketing and suppliers

text: A typical SME will process personal data of its customers and perform marketing activities so as to attract new customers. It may also process personal data in relation to its suppliers. Depending on the nature of business activities, the nature and amount of products and services portfolio, as well as the target market, the activities may differentiate and include processing of different types of personal data in a different scale or/and for different purposes. Order and delivery of goods Within the scope of this use case, we consider a retail SME that offers goods through a dedicated e-shop. Customers can browse through the available goods, add them to the cart and check out. In order to complete the order, the customer has to register at the e-shop platform (if not already registered) and provide her contact details (first and last name, delivery address, telephone number and email address). During the checkout process, registered users are also asked to provide payment details in a separate form, which is provided by the payment services provider. Following the successful placement of the order and the confirmation from the payment service provider, the details of the order are transmitted to the Enterprise Resource Planning (ERP) system, to the Customer Relation Management (CRM) system and to the delivery services provider. Regarding the use of the system there is a specific use policy in place and best practises are implemented and maintained. However, there are no specific policies regarding data retention and destruction and not all employees involved has received relevant information security training. 4.1.1 Definition of the processing operation and its context The specific data processing operation can be detailed, as follows:

text: PROCESSING OPERATION ORDER AND DELIVERY OF GOODS DESCRIPTION

text: Contact information (last and first name, address, telephone number) payment data

text: Personal Data Processed

text: (credit card, bank account information)

text: Processing Purpose Order and delivery of goods Data Subject Customers Processing Means Order Management system

text: External Payment services provider

text: External Delivery services provider

text: Recipients of the Data

text: Internal Customer Relation Management (CRM) system

text: Internal Enterprise Resource Planning (ERP) system

text: Data Processor Used In-house and external parties

text: 4.1.2 Evaluating Impact Loss of confidentiality and integrity Within the scope of the specific processing operation, as described earlier, the impact from loss of confidentiality and/or integrity is considered as MEDIUM, as unauthorized disclosure and/or alteration of personal data processed, including financial data, could result in significant inconveniences for the data subject (which can be recovered with some effort). Handbook on Security of Personal Data Processing

text: December 2017

text: Loss of availability The level of impact resulting from loss of availability is considered to be LOW, as unavailability of the personal data processed is expected to result only to minor inconveniences for the data subject which can easily be overcome, e.g. delay of the delivery of goods.

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: Medium Medium Low

text: Overall Impact Evaluation MEDIUM

text: The overall result of the evaluation of the impact is therefore MEDIUM. Further to the assumptions made in this example, there might be cases in which the overall impact could be different (higher) from the one calculated above. An example could be the case when goods available for order can reveal sensitive data about the individual, e.g. relating to her health, sexual or political and religious preferences. 4.1.3 Threat Occurrence Probability Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case:  Network & technical resources: The threat occurrence probability is MEDIUM, as part of the processing of personal data is performed through the internet and the processing system is interconnected to another internal and external IT systems. It is assumed for this use case that unauthorized access to personal data is prevented based on relevant best practices.  Processes/Procedures related to the processing of personal data: The threat occurrence probability is LOW, as it assumed that roles and responsibilities of employees are clearly defined in line with an acceptable use policy, the processing of personal data is limited to the premises of the organization and log files are created for any processing activity being performed.  Parties/People involved in the processing of personal data: The threat occurrence probability is MEDIUM as not all employees have received relevant information security training and it is not ensured that personal data are always securely processed and/or destroyed.  Business sector and scale of processing: The threat occurrence probability is MEDIUM as the business sector of the as the business sector of the SME (e-shop) can be considered in general as prone to cyberattacks and the processing operation does concern a large number of individuals. However, it is assumed for the particular case that a personal data breach has very occurred in the past.

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Network and Technical Resources Medium 2 Processes/Procedures related to the processing of personal data Low 1 Parties/People involved in the processing of personal data Medium 2 Business sector and scale of processing Medium 2

text: December 2017

text: Overall Threat Occurrence Probability Medium (7)

text: Following the aforementioned assessment, the overall threat occurrence probability is calculated as MEDIUM. 4.1.4 Evaluation of Risk Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. IMPACT LEVEL Low Medium High / Very High Low

text: THREAT OCCURRENCE

text: PROBABILITY Medium X High

text: In particular, the overall risk for this particular case is generally considered as MEDIUM. Annex A (A.1 & A.2) can be used for the adoption of measures appropriate to the risk presented. Note should be taken that the risk might be different (higher) under conditions directly related to the specific data processing operation and affecting either the impact or the threat occurrence probability (see also relevant considerations under section 4.1.2). Marketing/advertising Within the scope of this use case, we consider the retail SME described in section 4.1, which processes personal data of potential customers in order to promote the different kinds of goods available within its portfolio. For such processing to take place it is assumed that data subjects have already provided their consent via paper or electronic form (we do not make any legal analysis in the context of the use case). For this processing operation, the SME makes use of a dedicated web tool, offered by a third party provider who specializes in such activities. The third party provider is EU based and adheres to relevant security best practices. Each month, an officer from the marketing department, inserts to the web tool, through an appropriate web interface the contact information (first and last name, email address) of potential customers and updates the list with any potential customers that have requested not to be included in the list. Every week, the officer initiates a new marketing campaign through the web tool, which then sends respective personalized emails, to the lastly updated recipients list. For each campaign, the tool provides a report with statistics on the percentage of emails read, unread, deleted without however providing information on specific individuals. 4.2.1 Definition of the processing operation and its context The specific data processing operation can be detailed, as follows :

text: PROCESSING OPERATION MARKETING/ADVERTISING DESCRIPTION

text: Personal Data Processed Contact info (e.g name, postal address, telephone number, email)

text: December 2017

text: Processing Purpose Promotion of goods and special offers to possible customers Data Subject Customers and potential Customers Processing Means Third party marketing campaign web service

text: External Third party marketing campaign web service provider

text: Recipients of the Data Internal Marketing Department

text: Internal CRM IT system

text: Data Processor Used Third party marketing campaign web service provider

text: 4.2.2 Evaluating Impact Loss of confidentiality, integrity and availability Within the scope of the specific operation, the impact from loss of confidentiality, and/or integrity and/or availability is considered to be LOW, as individuals may encounter some minor inconvenience, e.g. by unauthorized disclosure of their contact info (which could lead to spam) or unauthorized modification of their data, excluding them from a potential marketing campaign. In all cases the issue can be easily resolved with some small effort.

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: Low Low Low

text: Overall Impact Evaluation LOW

text: The overall result of the evaluation of the impact is therefore LOW. Further to the assumptions made in this example, there might be cases where the overall impact could be different (higher) from the one calculated above. An example could be a case where the inclusion of the individual in a marketing campaign may reveal sensitive information, e.g. related to her racial or ethnic origin, political opinions or health status. Another example could be if the processing operation included processing of personal data in order to cultivate a better understanding of customers and potential customers’ habits, preferences and eventually orient appropriately their marketing strategies. This type of processing would then be characterized as ‘profiling’ and data related to data subject’s possible preferences and interests (acquired through the profiling process). Within the scope of this specific processing operation, the impact from loss of confidentiality would then be considered as MEDIUM, as individuals may encounter in certain cases significant problems by having their preferences, shopping habits, interests being accessed by third parties in an unknown way. It could be raised to HIGH, e.g. in case that this profiling is based on sensitive data. 4.2.3 Threat Occurrence Probability Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case:  Network & technical resources: The threat occurrence probability is MEDIUM, as the processing of personal data is performed through the internet and the processing system is interconnected to other internal and external IT systems. Handbook on Security of Personal Data Processing

text: December 2017

text:  Processes/Procedures related to the processing of personal data: The threat occurrence probability is LOW, as it is assumed that processes are well defined and the specialised third party adheres to security best practices in the field.  Parties/People involved in the processing of personal data: The threat occurrence probability is MEDIUM as part of the data processing operation is performed by a data processor (third party) and, thus, the SME is not in full control of the data. Still, it is assumed that the specialised third adheres to security best practices in the field.  Business sector and scale of processing: The threat occurrence probability is MEDIUM as the business sector of the SME (e-shop) is in general prone to cyberattacks and the processing operation does concern a large number of individuals. However, it is assumed that a personal data breach has never occurred in the past.

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Following the aforementioned assessment, the overall threat occurrence probability is calculated as MEDIUM. 4.2.4 Evaluation of Risk Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. IMPACT LEVEL Low Medium High / Very High Low

text: THREAT OCCURRENCE

text: PROBABILITY Medium X High

text: In particular, the overall risk for this particular case is considered as LOW. Annex A (A.1) can be used for the adoption of measures appropriate to the risk presented. Note should be taken that the risk might be different (Medium of even High) under conditions directly related to the specific data processing operation and affecting either the impact or the threat occurrence probability (see also relevant considerations under section 4.2.2). Suppliers of services and goods Within the scope of this use case, we consider the retail SME described in 4.1, which acquires services and goods needed for both day to day operation and also for sale of goods. These procedures may include in Handbook on Security of Personal Data Processing

text: December 2017

text: certain cases processing of personal data, for instance, contact data of specific employees working for the suppliers or contact and financial data of persons that are in direct contract with the SME (i.e. directly acting as suppliers of goods or services). The processing operation is supported by an IT system connected to the Enterprise Resource Planning (ERP) system and the Accounting System. The processed personal data include company name and contact details, financial data (tax number, banking account), employee pictures and access credentials (for staff working within premises). All business relationships between SMEs and suppliers take place using CRM via extranet, directly to the platforms of the suppliers. Payments are made using remote banking services. There is an off-line platform where delivery bills and invoices are loaded overnight in batches. Administrative communications with suppliers take place through ordinary email service. 4.3.1 Definition of the processing operation and its context

text: PROCESSING OPERATION PROCUREMENT (SUPPLY OF RAW MATERIALS, GOODS AND SERVICES) DESCRIPTION

text: First and last name, contact Information, tax and banking information (for supplier),

text: Personal Data Processed

text: picture and access credentials (for staff working on premises).

text: Processing Purpose Supply Management Data Subject Employees working for suppliers of goods and services Processing Means IT system

text: Internal Accounting system

text: Recipients of the Data

text: External Suppliers CRM

text: External Payment Services Provider

text: 4.3.2 Evaluating Impact Loss of confidentiality Within the scope of the specific processing operation, the impact from loss of confidentiality is considered as LOW, as individuals may encounter in certain cases minor problems by having their processed personal data being accessed by third parties in an unknown way. Loss of integrity and availability The impact from loss of integrity and/or availability is considered LOW as individuals may encounter the inconvenience of delaying the accomplishment of the business relationship between the companies, or could divert the ordered goods to an incorrect address or nor delivered at all, but this can be overcome with limited effort.

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: Low Low Low

text: December 2017

text: Overall Impact Evaluation LOW

text: The overall result of the evaluation of the impact is LOW. Further to the assumptions made in this use case, there might be cases where the overall impact could be different (higher) from the one calculated above. An example of such case could be when the company operates in a ‘sensitive’ environment and, thus, the disclosure of employees’ names might put them at risk (e.g. in a military environment). 4.3.3 Threat Occurrence Probability Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case:  Network & technical resources: The threat occurrence probability is MEDIUM, as the system is connected to the internet and it is possible to provide access to the internal personal data processing system through the internet. However, best practices are used to prevent unauthorized access.  Processes/Procedures related to the processing of personal data: The threat occurrence probability is LOW, as it is assumed that roles and responsibilities of personnel are clearly defined along to an acceptable use policy, employees are not allowed to bring their own devices and store, transfer or ortherwise process personal data outside the premises of the organization and log files are created for any processing activity being performed.  Parties/People involved in the processing of personal data: Threat occurrence probability for is LOW as employees are not able to transfer, store or otherwise process personal data outside the premises of the organization while the acceptable use of the network, system and physical resources within the organization is clearly defined and employees involved in the data processing operation securely store and destroy personal data.  Business sector and scale of processing: The threat occurrence probability is LOW as the business sector of the SME is in general not considered prone to cyberattacks, a security breach incident or a complaint has not been received during the last two years and the processing operation does not concern a large number of individuals.

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Network and Technical Resources Medium 2 Processes/Procedures related to the processing of personal data Low 1 Parties/People involved in the processing of personal data Low 1 Business sector and scale of processing Low 1

text: 4.3.4 Evaluation of Risk Handbook on Security of Personal Data Processing

text: December 2017

text: Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. IMPACT LEVEL Low Medium High / Very High Low X

text: THREAT OCCURRENCE

text: PROBABILITY Medium High

text: In particular, the overall risk for this particular case is generally considered as LOW. Annex A (A.1) can be used for the adoption of measures appropriate to the risk presented. Note should be taken that the risk might be different (Medium of even High) under conditions directly related to the specific data processing operation (see also relevant considerations under section 4.3.2). Handbook on Security of Personal Data Processing

text: December 2017

text: 5. Safety and security

text: Access control Within the scope of this use case, we consider as an example a consulting company (SME) that processes the personal data of its employees and visitors for physical access control within its premises, in order to ensure that only the authorized individuals have access into and out of specific areas. The deployed access control system comprises of RFID card readers installed in predefined points, RFID cards and the access control management platform. Each employee, upon taking up his or her duties, is registered to the access control management platform and is assigned a unique alphanumeric value which is stored in an RFID card. The personal data used during the registration include first and last name, date of employment, position within the organization, end of employment (if specified by the contract) and a profile picture. Each employee’s RFID card is personalized as the name of the employee and his/her profile picture are printed on the card. For each type of position within the organization (administration, manager, secretariat support etc.) specific access rights are predefined. Each time an employee swipes her card against a reader, the platform checks the rights and grants access to the premise accordingly. Each attempt is logged within the platform and in case of an unauthorized access attempt, the security officer is notified. Visitors are also issued respective anonymized visitor RFID cards which are preset to allow access only to meeting rooms. Upon arrival of a visitor, the security officer registers within the platform the first and last name of the visitor, the accompanying employee’s first and last name and the expected duration of the visit and assigns temporarily a RFID card to the visitor. Upon departure or expiry of the duration of visit, the card is invalidated and is returned to the security officer. Security officers operating the platform have received special training on the functions of the platform and their obligations and it is assumed that best practices are followed.

text: PROCESSING OPERATION ACCESS CONTROL DESCRIPTION

text: For employees: first and last name, date of employment, position within the

text: Personal Data Processed organization, end of employment, a profile picture.

text: For visitors: first and last name, date and time of visit, expected time of departure.

text: Processing Purpose Physical-logical Access Control Security Data Subject Employees, visitors Processing Means Access control management platform Recipients of the Data Internal Security Officer Data Processor Used In-house (no data processor)

text: 5.1.1 Evaluating Impact Loss of confidentiality, integrity and availability Within the scope of the specific processing operation, the impact from loss of confidentiality, and/or integrity and/or availability is considered to be LOW as individuals are expected to encounter minor inconveniences which they will be able to overcome with limited effort. For example, employees might not be able to access specific premises of the SME and perform their task (integrity or availability loss) or a visitor’s presence in the SME premises might be disclosed (confidentiality loss). Handbook on Security of Personal Data Processing

text: December 2017

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: Low Low Low

text: Overall Impact Evaluation LOW

text: The overall result of the evaluation of the impact is therefore LOW. Further to the assumptions made in this example, there might be cases where the overall impact could be different (higher) from the one calculated above. An example of such case is when the visit to the SME’s premises may reveal specific sensitive information, e.g. with regard to health, religious beliefs, political or sexual preferences. 5.1.2 Threat Occurrence Probability Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case:  Network & technical resources: The threat occurrence probability is LOW, as the system is not connected to the internet, it does not allow access from internet to internal resources and connection to other IT systems and it is assumed that best practices are used to prevent unauthorized access to the system.  Processes/Procedures related to the processing of personal data: The threat occurrence probability is LOW, as it is assumed that roles and responsibilities of security officer are clearly defined along to an acceptable use policy and log files are created for any processing activity being performed.  Parties/People involved in the processing of personal data: The threat occurrence probability is LOW as the security officer is not able to transfer, store or otherwise process personal data outside the premises of the organization while the acceptable use of the network, system and physical resources within the SME is clearly defined.  Business sector and scale of processing: The threat occurrence probability is LOW as the business sector of the SME is not in general considered prone to cyberattacks, a personal data breach has not occurred in the past and the processing operation does not concern a large number of individuals.

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Network and Technical Resources Low 1 Processes/Procedures related to the processing of personal data Low 1 Parties/People involved in the processing of personal data Low 1 Business sector and scale of processing Low 1

text: Overall Threat Occurrence Probability Low (4)

text: 5.1.3 Evaluation of Risk Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. Handbook on Security of Personal Data Processing

text: December 2017

text: IMPACT LEVEL Low Medium High / Very High THREAT Low X

text: OCCURRENCE

text: Medium

text: PROBABILITY

text: High In particular, the overall risk for this particular case is generally considered as LOW. Annex A (A.1) can be used for the adoption of measures appropriate to the risk presented. Note should be taken that the risk might be different (Medium or even High) under conditions directly related to the specific data processing operation and affecting either the impact or the threat occurrence probability (see also relevant considerations under section 5.1.2). For example, the threat occurrence probability might be higher in case where the SME operates in a ‘sensitive’ environment, e.g. a health data laboratory (thus, increasing the possibilities of malicious attempts to gain unauthorised access to premises). Moreover, account should be taken in general to the fact that access control is an integral measure for preventing unauthorised access to one’s premises and, thus, directly linked to security and safety of persons and goods. Therefore, depending again on the nature of the organisation, the SME might consider increasing the overall risk to MEDIUM or even HIGH. Closed Circuit Television System (CCTV) Within the scope of this use case, we consider the SME described in section 5.1, which also processes personal data by means of CCTV (images and video with no sound), in order to enhance the security and safety of people and goods in their premises. It should be noted that the use case does not aim at making any legal analysis or on the use of CCTV; we, therefore, assume that the processing is GDPR compliant and that the guidance of the Data Protection Authority (DPA) has been taken into account. Still, we note that in all cases special attention should be paid to the legal basis of CCTV operation, which should be in compliance with both data protection and labour legal and normative requirements and obligations. The CCTV system in our example comprises of the camera, and the CCTV management IT system which records the feed, displays it to the security officers and logs any activity on processing non –real time feeds. The feed is stored for the time indicated by the DPA and is then automatically deleted securely, unless the operator extracts it manually for cases which require further examination (for example a security alarm during non-working hours, etc.) Security officers operating the platform have received special training on the functions of the platform and their obligations and it is assumed that best practises are used to avoid authorized access to the feed. Special attention should be paid to the legal basis of the installation and operation of the CCTV system, which should be in compliance to both data protection and labour legal and normative requirements and obligations. 5.2.1 Definition of the processing operation and its context Handbook on Security of Personal Data Processing

text: December 2017

text: PROCESSING OPERATION CCTV DESCRIPTION

text: Personal Data Processed Image and video of persons (employees, visitors). Processing Purpose Physical Security of personnel, visitor and goods Data Subject Employees, visitors Processing Means CCTV IT system Recipients of the Data Internal Data Processor Used In-house (no data processor)

text: 5.2.2 Evaluating Impact Loss of confidentiality Within the scope of the specific processing operation, the impact from loss of confidentiality is considered to be LOW as individuals might in certain cases encounter minor inconvenience or discomfort, for example if the presence of a visitor in the SMEs premises is unwantedly revealed. Loss of integrity and availability The loss of integrity is rather hard to achieve (from a technical point of view) in this particular case, as it would require manipulation of the video images. Loss of availability relates to the unavailability (full or temporal) of video footage. In both cases, the impact is considered LOW and it could even be stated that there is no impact for the individuals at all (as loss of CCTV footage is a problem for the SME, but not for the individuals who are being recorded).

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: Low Low Low

text: Overall Impact Evaluation LOW

text: The overall result of the evaluation of the impact is therefore LOW. Further to the assumptions made in this example, there might be cases where the overall impact could be different (higher) from the one calculated above. An example of such case is when the visit to the SME’s premises could reveal or infer sensitive information, e.g. related to health status, religious beliefs, political or sexual preferences. 5.2.3 Threat Occurrence Probability Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case:  Network & technical resources: The threat occurrence probability is LOW, as the system is assumed to not be connected to the internet and best practices are used to prevent unauthorized access.  Processes/Procedures related to the processing of personal data: The threat occurrence probability is LOW, as roles and responsibilities of security officers are clearly defined along to an acceptable use policy and log files are created for any processing activity being performed Handbook on Security of Personal Data Processing

text: December 2017

text:  Parties/People involved in the processing of personal data: The threat occurrence probability is LOW as employees are not able to transfer, store or otherwise process CCTV data outside the premises of the organization while the acceptable use of the network, system and physical resources within the organization is clearly defined.  Business sector and scale of processing: The threat occurrence probability is LOW as the business sector of the SME is not in general considered as prone to cyberattacks and, a personal data breach has not occurred in the past. Moreover, the processing operation does concern a large number of individuals.

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: 5.2.4 Evaluation of Risk Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. IMPACT LEVEL Low Medium High / Very High Low X

text: THREAT OCCURRENCE

text: PROBABILITY Medium High

text: In particular, the overall risk for this particular case is generally considered as LOW. Annex A (A.1) can be used for the adoption of measures appropriate to the risk presented. Note should be taken that the risk might be different (Medium or even High) under conditions directly related to the specific data processing operation and affecting either the impact or the threat occurrence probability (see also relevant considerations under section 5.2.2). For example, the threat occurrence probability might be higher in case where the SME uses advanced CCTV systems, which allow zooming and video recording (note that in such cases the overall legality of the data processing operation should be carefully analysed). Handbook on Security of Personal Data Processing

text: December 2017

text: 6. Specific use case: Health sector

text: Health Services Provision Within the scope of this use case, we consider an SME in the health care domain (small clinic) which processes personal data in order to provide healthcare services. For each patient visiting the clinic to perform an examination or a consultation visit, an electronic record is created (or updated) and includes patients’ contact details, social insurance number, medical exams’ results, pathologies, allergies, diagnosis and cure schemas (medical information). Through this record, treating doctors and nurses have an overview of the history and the status of the patients’ health and can access it if needed from pre-defined terminals within the clinic premises. Prior to the medical examination or consultation visit, the eligibility of the patient to receive such examination or treatment without covering its cost is validated against the public health system records. If the patient or exanimation is not eligible, the cost is communicated to the accounting IT system which issues the respective invoice. After each examination or consultation visit, patient records are updated with the latest data by the treating doctor or nurse either by scanning paper based documents or inserting manually diagnosis and cure schemas. The IT platform supporting this processing operation, is hosted within the premises of the SME and it is not accessible through the Internet. For the purpose of the use case, it is assumed that best practises are used to prevent unauthorized access to the platform and that periodical security awareness raising trainings are being organized. Still, access rights to the patients’ medical records are not explicitly defined at a granular level, as nurses and doctors need to be able to access the files at any time and the system does not support relevant granularity. The SME plans to have a more dedicated patient record system within the next years. 6.1.1 Definition of the processing operation and its context

text: PROCESSING OPERATION HEALTH SERVICES PROVISION DESCRIPTION

text: Contact Information (last and first name, address, telephone number,) social insurance number, medical examination results, pathologies, allergies, diagnosis and cure

text: Personal Data Processed

text: schemas (medical information), administrative and financial information (invoices, hospitalisation papers, etc.).

text: Processing Purpose Provision of healthcare services (diagnosis, treatment an hospitalisation) Data Subject Patients Processing Means Medical IT system

text: Internal Treating doctors and nurses

text: Recipients of the Data Internal Administration and accounting IT system

text: External Public Health System

text: 6.1.2 Evaluating Impact Loss of confidentiality, integrity and availability Within the scope of the specific processing operation, the impact from loss of confidentiality is considered to be HIGH as individuals are expected to encounter major adverse effects through unauthorized access to their health related data. Equally important (HIGH) may be the loss of integrity, as wrong medical Handbook on Security of Personal Data Processing

text: December 2017

text: information might even put an individual’s life at risk. The same (HIGH) could be argued also for the loss of availability, as even a temporal unavailability of the clinic’s IT system might hinder its operations, thus putting patients at serious risk.

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: High High High

text: Overall Impact Evaluation HIGH

text: The overall result of the evaluation of the impact is therefore HIGH. Further to the assumptions made in this example, there might be cases where the overall impact could even be considered as VERY HIGH, for example in cases of vulnerable categories of data subjects or minors. 6.1.3 Threat Occurrence Probability Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case:  Network & technical resources: The threat occurrence probability is MEDIUM, as the system is interconnected to other external and internal systems. However, the data cannot be accessed via the Internet and, according to the use case description, security best practices have been applied to prevent unauthorized access to the system.  Processes/Procedures related to the processing of personal data: The threat occurrence probability is LOW, as roles and responsibilities of personnel are clearly defined along to an acceptable use policy, the processing of data is limited in the premises of the SME and log files are created for any processing activity being performed.  Parties/People involved in the processing of personal data: The threat occurrence probability is HIGH as processing of personal data is performed by an undefined number of employees and there is no clear policy regarding granular access to the health records. However, the obligations of all parties involved in the processing are clearly defined and awareness raising seminars are organized periodically.  Business sector and scale of processing: The threat occurrence probability is HIGH as the business sector of the SME (healthcare) is in generally considered prone to cyberattacks and the processing operation does concern a large number of individuals. However, it is assumed that as personal data breach has not occurred in the past.

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Network and Technical Resources Medium 2 Processes/Procedures related to the processing of personal data Low 1 Parties/People involved in the processing of personal data High 3 Business sector and scale of processing High 3

text: Overall Threat Occurrence Probability HIGH (9)

text: December 2017

text: 6.1.4 Evaluation of Risk Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. IMPACT LEVEL Low Medium High / Very High Low

text: THREAT OCCURRENCE

text: PROBABILITY Medium High X

text: In particular, the overall risk for this particular case is generally considered as HIGH. Annex A (A.1 & A.2 & A.3) can be used for the adoption of measures appropriate to the risk presented. Medically Assisted Procreation Within the scope of this use case, we consider an SME in the health care domain specializing in Medically Assisted Procreation (MAP) that processes personal data for management and tracking of biological samples stored within its premises. MAP includes different methods or techniques based on the manipulation of reproductive cells that will allow infertile couples to conceive a child. MAP procedures also include cryopreservation techniques for gametes (oocytes and spermatozoa) and embryos. The IT system deployed internally to support MAP holds records for each sample that include: information of the donor (first and last name, address, telephone number, date of birth), social insurance number, health data, genetic sample data and genetic sample identifier. Through the platform, the operator can perform the following functions: a) sample management, traceability of all sample manifestations, sample position management within cryogenic containers, and b) access management and registration of cryopreserved samples. Regarding the use of the IT system, a specific use policy is in place alongside specific policies regarding data retention and destruction. Processing of personal data is limited to the premises of the SME. Access to the platform is allowed only to specific employees of the SME, acting as the operators, and to the doctor and biologist employees responsible for performing MAP. All platform users have been clearly informed about their obligations regarding personal data processing and awareness-raising training is organized periodically. The platform is not connected to the internet and it is assumed that best practises are used to prevent unauthorised access. 6.2.1 Definition of the processing operation and its context The specific data processing operation can be detailed, as follows:

text: PROCESSING OPERATION MANAGEMENT OF BIOLOGICAL SAMPLES FOR MEDICALLY ASSISTED PROCREATION DESCRIPTION

text: Information of the donor (first and last name, address, telephone number, date of

text: Personal Data Processed birth), social insurance number, health data, genetic sample data and genetic sample

text: identifier

text: Processing Purpose Management of genetic sampled for Medically Assisted Procreation (MAP) Data Subject Donors

text: December 2017

text: Processing Means Medically Assisted Procreation Management IT system Recipients of the Data Internal Data Processor Used In-house (no data processor)

text: 6.2.2 Evaluating Impact Following the approach presented in section 2.1.2, the following analysis can be made: Loss of confidentiality, integrity and availability Within the scope of the specific processing operation the impact from loss of confidentiality is considered HIGH, as data subjects are expected to encounter significant adverse effects from unauthorised disclosure of health and genetic data. The impact from loss of integrity or availability is equally important (HIGH), as data subjects are expected to encounter significant or even irreversible inconvenience from unauthorised alteration or loss of health and genetic data, which could even prevent them from undergoing a MAP procedure.

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: High High High

text: Overall Impact Evaluation HIGH

text: The overall result of the evaluation of the impact is the highest identified and therefore the overall impact evaluated is HIGH Further to the assumptions made in this example, there might be cases where the overall impact could be even be considered as VERY HIGH, for example, in cases of vulnerable categories of data subjects (e.g. data subjects with specific diseases or handicaps) 6.2.3 Threat Occurrence Probability  Network & technical resources: The threat occurrence probability is LOW, as the system is not connected to the internet, it is not possible to provide access to the internal personal data processing system through the internet and best practices are used to prevent unauthorized access.  Processes/Procedures related to the processing of personal data: The threat occurrence probability is LOW, as roles and responsibilities of personnel are clearly defined along to an acceptable use policy, the processing is limited to the premises of the SME and log files are created for any processing activity being performed.  Parties/People involved in the processing of personal data: The threat occurrence probability is LOW as processing of personal data is performed by a defined number of employees with clearly defined obligations and it is assumed that employees involved in the data processing operation securely store and destroy personal data.  Business sector and scale of processing: The threat occurrence probability is HIGH as the business sector of the SME could be considered as prone to cyberattacks and could potentially concern a large number of individuals. However, it is assumed that no personal data breach is known to have occurred in the past. Handbook on Security of Personal Data Processing

text: December 2017

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Network and Technical Resources Low 1 Processes/Procedures related to the processing of personal data Low 1 Parties/People involved in the processing of personal data Low 1 Business sector and scale of processing High 3

text: 6.2.4 Evaluation of Risk Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. IMPACT LEVEL Low Medium High / Very High Low

text: THREAT OCCURRENCE

text: PROBABILITY Medium X High

text: In particular, the overall risk for this particular case is generally considered as HIGH. Annex A (A.1 & A.2 & A.3) can be used for the adoption of measures appropriate to the risk presented. Remote monitoring of patients with chronic diseases Within the scope of this use case, we consider an SME in the health care domain specializing in providing homecare remote monitoring services for patients who have been diagnosed with a chronic condition. Each patient is provided with a monitoring device, which allows real time tracking of vital signs and transmission of information such as blood pressure, glucose level, pulse and ECG rhythm in set intervals diagnoses to the affiliated healthcare centre. The monitoring device also acts as a communication device, enabling patients to respond to personalized clinician-directed surveys related to the compliance level of treatment schemas. The remote monitoring device is supported by a web-based platform, hosted by a cloud provider within the EU, which collects and correlates all data transmitted in order to detect any deviations from the clinical protocol and determine the overall health status of the patient. Should a deviation from acceptable values and procedures is detected, a medical practitioner communicates through phone with the patient to determine whether an in house visit is required. The personal data involved in the processing operation include patients’ personal information, such as first and last name, address, telephone numbers, date of birth, alongside social insurance number, health status data, diagnosis results, treatment schemas, vital signs readings and relevant statistics. The web platform is operated by authorized medical practitioners with clearly defined roles, responsibilities and obligations related to personal data processing. Handbook on Security of Personal Data Processing

text: December 2017

text: 6.3.1 Definition of the processing operation and its context

text: PROCESSING OPERATION REMOTE MONITORING OF PATIENTS WITH CHRONIC DISEASES DESCRIPTION

text: First and last name, address, telephone numbers, date of birth, social insurance

text: Personal Data Processed number, health status data, diagnosis results, treatment schemas, laboratory test

text: results and relevant statistics.

text: Processing Purpose Healthcare service provision (remote monitoring of patients with chronic diseases_ Data Subject Patients Processing Means Remote Monitoring devices, Monitoring web-based platform

text: External

text: Recipients of the Data

text: Internal

text: Data Processor Used Hosting cloud provider

text: 6.3.2 Evaluating Impact Loss of confidentiality, integrity and availability Within the scope of the specific processing operation, the impact from loss of confidentiality is considered HIGH as data subjects are expected to encounter significant adverse effects from unauthorised disclosure of their health data. The loss of integrity is equally important (HIGH), as data subjects are expected to encounter significant or even irreversible inconvenience from unauthorised alteration of health data (signals and statistics), which could even make it difficult for them to receive appropriate treatment. The loss of availability is also HIGH, as it could again hinder the timely and accurate treatment of the data subjects, which could even put their lives at risk.

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: High High High

text: Overall Impact Evaluation HIGH

text: The overall result of the evaluation of the impact is the highest identified and therefore the overall impact evaluated is HIGH. Further to the assumptions made in this example, there might be cases where the overall impact could even be considered as VERY HIGH, for example, when the processing relates to minors. 6.3.3 Threat Occurrence Probability Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case:  Network & technical resources: The threat occurrence probability is HIGH, as the system is connected to the internet and it is possible to provide access to the internal personal data processing system through the internet. Moreover, different tools and systems are interconnected and many different systems need to be equally secured. Handbook on Security of Personal Data Processing

text: December 2017

text:  Processes/Procedures related to the processing of personal data: The threat occurrence probability is MEDIUM, as roles and responsibilities are complex in this scenario, due to many different actors and systems involved.  Parties/People involved in the processing of personal data: The threat occurrence probability is HIGH as a data processor is used, which is based on the cloud. Still, the processing is performed by a predefined number of employees and it is assumed that they receive periodic awareness raising trainings.  Business sector and scale of processing: The threat occurrence probability is HIGH as the business sector of the SME could be considered as prone to cyberattacks and could potentially concern a large number of individuals. However, it is assumed that no personal data breach is known to have occurred in the past.

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Network and Technical Resources High 3 Processes/Procedures related to the processing of personal data Medium 2 Parties/People involved in the processing of personal data High 3 Business sector and scale of processing High 3

text: Overall Threat Occurrence Probability High (11)

text: 6.3.4 Evaluation of Risk Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. IMPACT LEVEL Low Medium High / Very High Low

text: THREAT OCCURRENCE

text: PROBABILITY Medium High X

text: In particular, the overall risk for this particular case is generally considered as HIGH. Annex A (A.1 & A.2 & A.3 can be used for the adoption of measures appropriate to the risk presented. Handbook on Security of Personal Data Processing

text: December 2017

text: 7. Specific use case: Education sector

text: Early childhood – Crèche Within the scope of this use case, we consider an early childhood school which uses a web platform to support communication of day to day physical, intellectual, language, emotional and social activities of minors between the school and the parents. In addition, the platform may also include information on the childrens’ health, appetite and disposition (provided by the parents). Parents are also able to communicate with the educator and seek advice and support on how to nurture and better support the cognitive and social-emotional development of their infant. The platform is hosted at an EU based hosting provider and operated by the educators. Each educator manages and updates information about the children assigned to his or her classroom, while the overall administration of the platform is performed by the secretariat of the school. Parents are registered to the platform by the secretariat and can only access and update the data of their child. It is assumed that best practices are being used to prevent unauthorized access, roles and responsibilities of employees involved are clearly defined and communicated, and log files are created for all data processing activities. The platform processes the following data: first and last name, date of birth, home address, daily information on the child’s performance (including eating, activities, etc.), health data, allergies, nutrition intolerances, parent(s) first and last name, parent(s) telephone number, emergency contact number. 7.1.1 Definition of the processing operation and its context

text: PROCESSING OPERATION EARLY CHILDHOOD SCHOOL COMMUNICATION PLATFORM DESCRIPTION

text: First and last name, date of birth, home address, daily information on the child’s performance (including eating, activities, etc.), health data, allergies, nutrition

text: Personal Data Processed

text: intolerances, parent(s) first and last name, parent(s) telephone number, emergency contact number

text: Provision of educational services (communication of day to day activities and child’s

text: Processing Purpose

text: development)

text: Data Subject Children and parents Processing Means Web based

text: External Parents

text: Recipients of the Data

text: Internal Secretariat, Educators

text: Data Processor Used Web hosting provider

text: 7.1.2 Evaluating Impact Loss of confidentiality Within the scope of the specific processing operation, the impact from loss of confidentiality is considered as MEDIUM, as in certain cases individuals (children and parents) may encounter significant inconvenience from the disclosure of certain data (e.g. regarding the child’s behavior or communication or eating patterns). Handbook on Security of Personal Data Processing

text: December 2017

text: Loss of integrity The loss of integrity can also be considered as MEDIUM, as unauthorized modification of this data could possibly hinder the appropriate provision of services by the crèche (especially with regard to allergies, nutrition patterns and other related data). Loss of availability The loss of availability can be considered as LOW, since the unavailability of the data can lead to some minor inconvenience that can be easily overcome (e.g. by entering again the data in the platform or communicating with the parents through other means)..

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: Medium Medium Low

text: Overall Impact Evaluation MEDIUM

text: The overall result of the evaluation of the impact is the highest identified and therefore the overall impact evaluated is MEDIUM. Further to the assumptions made in this example, there might be cases where the overall impact could be higher than the one calculated above. An example of such case is when there are particular diet plans followed by specific children (e.g. due to religious beliefs). Another example is the case of a school specifically dedicated to children with special conditions or disabilities. 7.1.3 Threat Occurrence Probability Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case:  Network & technical resources: The threat occurrence probability is MEDIUM, as the system is connected to the internet and it is possible to provide access to the internal personal data processing system through the internet. However, best practices are used to prevent unauthorized access and it is assumed that these are up-to-date.  Processes/Procedures related to the processing of personal data: The threat occurrence probability is MEDIUM, as there are different parties accessing the same platform and it is not clear if roles and responsibilities have been clearly defined. Still, there is an acceptable use policy in place and log files are created for any processing activity being performed.  Parties/People involved in the processing of personal data: The threat occurrence probability is MEDIUM as a third party data processor is being used and employees are able to transfer, store or otherwise process personal data outside the premises of the school. However, it is assumed that acceptable use of the network, system and physical resources is clearly defined.  Business sector and scale of processing: The threat occurrence probability is LOW as the business sector of the SME (education) is not in general considered as prone to cyberattacks and the processing operation does not concern a large number of individuals. It is assumed that no personal data breach has even occurred in the past. Handbook on Security of Personal Data Processing

text: December 2017

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Network and Technical Resources Medium 2 Processes/Procedures related to the processing of personal data Medium 2 Parties/People involved in the processing of personal data Medium 2 Business sector and scale of processing Low 1

text: 7.1.4 Evaluation of Risk Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. IMPACT LEVEL Low Medium High / Very High Low

text: THREAT OCCURRENCE

text: PROBABILITY Medium X High

text: In particular, the overall risk for this particular case is generally considered as MEDIUM. Annex A (A.1& A.2) can be used for the adoption of measures appropriate to the risk presented. Note should be taken that the risk might be different (higher) under conditions directly related to the specific data processing operation and affecting either the impact or the threat occurrence probability (see also relevant considerations under section 7.1.2). University e-learning platform Within the scope of this use case we consider a university which offers an e-learning and course management platform hosted internally in a web server. Through the platform, professors and administration can send announcements to students and students can retrieve their course materials, lecture notes and slides, submit assignments, undertake assessments and tests and get evaluation results and grades. At the beginning of each semester the University’s administration department enrols students to modules (courses) and assigns respective privileges to both students and academic staff. It is assumed that best practices are being used to prevent unauthorized access, roles and responsibilities of employees involved are clearly defined and communicated, and log files are created for all data processing activities. For evaluation results, professors submit the final scores to administration in paper, and administration encodes them to the platform. The platform processes the following data: a) Students: first and last name, date of birth, date of admission, selected course(s), evaluation results, grades; b) Academic Staff: first and last name, date of birth, course(s) assigned. Handbook on Security of Personal Data Processing

text: December 2017

text: 7.2.1 Definition of the processing operation and its context

text: PROCESSING OPERATION UNIVERSITY’S E-LEARNING PLATFORM DESCRIPTION

text: Students: first and last name, date of birth, date of admission, selected course(s),

text: Personal Data Processed evaluation results, grades; Academic Staff: first and last name, date of birth, course(s)

text: assigned

text: e-Learning and course management platform, including undertaking of assignments

text: Processing Purpose

text: and test

text: Data Subject Students, Professors Processing Means e-Learning and course management platform

text: Internal University administration

text: Recipients of the Data

text: Internal Head of Departments

text: 7.2.2 Evaluating Impact Loss of confidentiality Within the scope of the specific processing operation, the impact from loss of confidentiality is considered as MEDIUM, as data subjects are expected to encounter significant inconvenience from unauthorised disclosure of personal data relating their academic performance, grades and results. Loss of integrity The impact from loss of confidentiality is considered also as MEDIUM, since data subjects are expected to encounter significant inconvenience from unauthorised alteration of personal data which directly influence their performance and grades. Loss of availability The impact from loss of confidentiality is considered LOW, as data subjects are expected to encounter minor inconvenience from unavailability of personal data, which can be easily overcome (assuming that there are back-ups and information on evaluation results and grades is also stored offline).

text: IMPACT ASSESSMENT

text: Confidentiality Integrity Availability

text: Medium Medium Low

text: Overall Impact Evaluation MEDIUM

text: The overall result of the evaluation of the impact is the highest identified and therefore the overall impact evaluated is MEDIUM. Further to the assumptions made in this example, there might be cases where the overall impact could be different (higher) than the one calculated above. An example of such case could be the possible integration of the platform with social network profiles, where other data are also collected about the students (e.g. lifestyle, habits, etc.). Another example could be the possible use of the platform for statistics and Handbook on Security of Personal Data Processing

text: December 2017

text: analytics. Note should be taken that in both of these cases, the overall legality of the data processing operations should be carefully assessed. 7.2.3 Threat Occurrence Probability Based on the questions and approach presented in Section 2.1.3, the following assessment can be made for each dimension of the specific data processing environment of this use case:  Network & technical resources: The threat occurrence probability is MEDIUM, as the system is connected to the internet and it is possible to provide access to the internal personal data processing system through the internet. However, it is assumed that best practices are used to prevent unauthorized access and that these are up-to-date.  Processes/Procedures related to the processing of personal data: The threat occurrence probability is MEDIUM, due to the different parties accessing the system and the fact that roles and responsibilities need to be very clearly set. Still, it is assumed that there is a specific acceptable use policy and log files are created for any processing activity being performed.  Parties/People involved in the processing of personal data: The threat occurrence probability is LOW as a third party data processor is being used and. However, it is assumed that acceptable use of the network, system and physical resources is clearly defined and employees are able to transfer, store or otherwise process personal data outside the premises of the school.  Business sector and scale of processing: The threat occurrence probability is MEDIUM as the processing operation does concern a large number of individuals and the business sector of the SME (higher education - university) could potentially be prone to cyberattacks. It is assumed that no personal data breach is known to have occurred in the past

text: PROBABILITY ASSESSMENT AREA LEVEL SCORE

text: Network and Technical Resources Medium 2 Processes/Procedures related to the processing of personal data Medium 2 Parties/People involved in the processing of personal data Low 1 Business sector and scale of processing Medium 1

text: 7.2.4 Evaluation of Risk Using the results from impact assessment and threat occurrence probability, the risk is calculated based on Section 2.1.4. IMPACT LEVEL Low Medium High / Very High Low

text: THREAT OCCURRENCE

text: PROBABILITY Medium X High

text: December 2017

text: In particular, the overall risk for this particular case is generally considered as MEDIUM. Annex A (A.1 & A.2) can be used for the adoption of measures appropriate to the risk presented. Note should be taken that the risk might be different (higher) under conditions directly related to the specific data processing operation and affecting either the impact or the threat occurrence probability (see also relevant considerations under section 7.2.2). Handbook on Security of Personal Data Processing

text: December 2017

text: 8. Conclusions

text: Security of personal data processing is already a legal obligation for data controllers, however the imminent General Data Protection Regulation reinforces the relevant provisions (both in substance and context) and extends this responsibility directly also to data processors. Considering the specific characteristics of SMEs, such as limited resources and unavailability of qualified personnel, this report builds on top of the methodological steps of the ENISA’s 2016 guidelines for SMEs (on the security of personal data processing) and provides a practical demonstration of the aforementioned steps through specific use cases. Each use case corresponds to a specific personal data processing operation and makes specific assumptions on the data processing environment and overall context of processing. The provided examples focus only on security measures and do not aim at providing any legal analysis or assessment of compliance with GDPR for the specific data processing operations. While performing the analysis of selected use cases, a number of conclusions and relevant recommendations were drawn and are discussed below. Guidance Needed Similar personal data processing operations may differ among data controllers, taking into consideration their specificities, the means used for the processing of personal data, the categories of data subjects, the data processors and the recipients of data. Therefore, a one-size fits all approach on the overall risk based approach, which extends beyond the data security provisions, cannot be regarded as viable and pragmatic. Each processing operation should be reviewed separately taking also into account the context and environment of the processing. Therefore, instead of a priori categorizing processing operations into risk levels, the focus should be shifted on empowering and guiding the data controllers to first comprehend their processing operations and then evaluate the level of risk and deploy the appropriate security measures. Competent EU bodies, EU policy makers and regulators (e.g. Data Protection Authorities) should develop practical and scalable guidelines that will be able to support and assist different types of data controllers and address specific stakeholders’ communities. Skilled DPO’s The empowerment of data controllers can also be perceived as a matter of raising their awareness to their processing operations and the overall GDPR provisions. In order, though, to be able to manage their compliance in a more structured manner, rather than a sporadic remedial action, it is expected that they will seek support and guidance. The role of an appropriately qualified Data Protection Officer (DPO) is central in this approach, even when the designation of a DPO is not mandatory according to GDPR

text: Article 37

text: . Having said that, it is important to note that the fulfilment of this role requires both a good understanding of the data protection legal framework, as well as the modern IT technologies (and relevant security best practices), which form the basis for most common data processing means today . See relevant guidelines on Data Protection Officers issued by

text: Article 29

text: Data Protection Working Party, http://ec.europa.eu/newsroom/document.cfm?doc_id=43823 Handbook on Security of Personal Data Processing

text: December 2017

text: Competent EU bodies, EU policy makers and regulators (e.g. Data Protection Authorities) should promulgate a set of baseline professional skills and requirements that Data Protection Officers’ should meet. Demonstrating Compliance As discussed earlier, the security of personal data processing should not be regarded by data controllers as an isolated obligation under GDPR but as part of the overall compliance framework they should develop, implement and maintain. The ENISA methodology can be useful in this regard in all cases where risk assessment is envisaged under the Regulation (e.g. personal data breach notification). Throughout the development of the aforementioned compliance framework, data controllers should try to extend the documentation of their approach, beyond the level imposed by GDPR provisions. This not only ensures that they actively and positively consider the risks of any data processing they undertake but will also step up their efforts with regards to the accountability principle and demonstrating compliance. Furthermore, as the risk based approach is integral part of Data Protection Impact Assessment (DPIA), it is expected that availability of documentation will also facilitate the undertaking, even on a voluntary basis, of the DPIA. SMEs communities/associations and data controllers should engage in the notion of risk assessment and relevant structured documentation as an integral part of information management systems for personal data. Regulators (e.g. Data Protection Authorities) should provide guidance and support training for data controllers in this context. Scalable Certification Schemes The data protection certification mechanisms of GDPR (Articles

text: and

text: ) have the potential to play a significant role in enabling data controllers to achieve and demonstrate the existence of appropriate safeguards, including security measures, and therefore compliance of their processing operations with GDPR provisions. As data controllers, and especially SMEs, are relying more and more on third party technologies, products and services, it is important to be encouraged and motivated to assess the level of conformity of these parties and, if possible, acquire such certifications. Given the voluntary nature of certification mechanisms under GDPR, it is crucial that data controllers are motivated and encouraged to adhere to certification schemes, as well as opt for data processors that are following similar practices. EU policy makers and regulators (e.g. Data Protection Authorities) should define and promote scalable data protection certification schemes, that meet the needs of SMEs and empower them to achieve and demonstrate compliance. SME communities/associations and data controllers should opt for data processors that adhere to security best practices and relevant certification mechanisms. Novel Risk Management Methodologies Information security risk management and risk management of personal data security regard the calculation of risk levels from two different standpoints: the first one focuses on the impact for the data Handbook on Security of Personal Data Processing

text: December 2017

text: controller and the latter on the impact for data subjects. However, both approaches result in proposed sets of organizational and technical measures to be implemented, maintained and reviewed by the data controller. Regardless of the specificities described earlier, a common methodology, embracing both aspects, could enable data controllers, specifically SMEs, to follow a systematic approach towards reaching compliance. The research community and competent EU bodies, in close collaboration with regulators (e.g. Data Protection Authorities), should propose and put forward methodologies that combine security risk management and risk management of personal data. Communication and Awareness Raising EU SMEs are only starting to consider the changes they should undertake and broaden the perspective of their existing information security and business strategies in order to meet the legal requirements. However, the extent of change(s) required, in order to integrate them into existing business processes, cannot be foreseen. Data controllers are often reluctant and perceive such changes as a barrier rather than an opportunity to position themselves in a newly created market, reinforcing also their customers’ confidence and trust. SME communities and associations, in close collaboration with competent EU bodies and regulators (e.g. Data Protection Authorities), should communicate and encourage data controllers to undertake actions towards security and privacy compliance as a competitive advantage alongside the underlying legal obligations. Handbook on Security of Personal Data Processing

text: December 2017

text: Annex A: Organizational and Technical Measures

text: Under each section, measures are presented per risk level (low: green, medium: yellow, high: red). In order to achieve scalability, it is assumed that all measures described under the low level (green) are applicable to all levels. Similarly, measures presented under the medium level (yellow) are applicable also to high level of risk. Measures presented under the high level (red) are not applicable to any other level of risk. Proposed Measures for Low Risk Level

text: RELEVANT MEASURE MEASURE CATEGORY MEASURE DESCRIPTION ISO/IEC 27001: 2013 CONTROL IDENTIFIER

text: The organization should document its Security policy and procedures for policy with regards to personal data

text: A.1 A.5 Security policy

text: the protection of personal data processing as part of its information security policy.

text: The security policy should be Security policy and procedures for A.2 reviewed and revised, if necessary, A.5 Security policy the protection of personal data on an annual basis.

text: Roles and responsibilities related to the processing of personal data

text: A.6.1.1 Information security

text: Roles and responsibilities B.1 should be clearly defined and

text: roles and responsibilities

text: allocated in accordance with the security policy.

text: During internal re-organizations or terminations and change of employment, revocation of rights and A.6.1.1 Information security Roles and responsibilities B.2 responsibilities with respective hand roles and responsibilities over procedures should be clearly defined.

text: Specific access control rights should be allocated to each role (involved in Access control policy C.1 A.9.1.1 Access control policy the processing of personal data) following the need to know principle.

text: The organization should have a register of the IT resources used for the processing of personal data (hardware, software, and network). The register could include at least the Resource/asset management D.1 following information: IT resource, A.8 Asset management type (e.g. server, workstation), location (physical or electronic). A specific person should be assigned the task of maintaining and updating the register (e.g. IT officer).

text: IT resources should be reviewed and Resource/asset management D.2 A.8 Asset management updated on regular basis.

text: December 2017

text: MEASURE RELEVANT MEASURE CATEGORY MEASURE DESCRIPTION ISO/IEC 27001: 2013 CONTROL IDENTIFIER

text: The organization should make sure that all changes to the IT system are

text: A. 12.1 Operational

text: registered and monitored by a Change management E.1 procedures and specific person (e.g. IT or security

text: responsibilities

text: officer). Regular monitoring of this process should take place.

text: Software development should be performed in a special environment that is not connected to the IT system used for the processing of personal

text: A. 12.1 Operational

text: data. When testing is needed, Change management E.2 procedures and dummy data should be used (not real

text: responsibilities

text: data). In cases that this is not possible, specific procedures should be in place for the protection of personal data used in testing.

text: Formal guidelines and procedures covering the processing of personal data by data processors (contractors/outsourcing) should be defined, documented and agreed between the data controller and the Data processors F.1 data processor prior to the A.15 Supplier relationships commencement of the processing activities. These guidelines and procedures should mandatorily establish the same level of personal data security as mandated in the organization’s security policy.

text: Upon finding out of a personal data breach, the data processor shall Data processors F.2 A.15 Supplier relationships notify the controller without undue delay.

text: Formal requirements and obligations should be formally agreed between the data controller and the data Data processors F.3 A.15 Supplier relationships processor. The data processor should provide sufficient documented evidence of compliance.

text: An incident response plan with detailed procedures should be Incidents handling / Personal data A.16 Information security G.1 defined to ensure effective and breaches incident management orderly response to incidents pertaining personal data.

text: Personal data breaches should be reported immediately to the management. Notification Incidents handling / Personal data A.16 Information security G.2 procedures for the reporting of the breaches incident management breaches to competent authorities and data subjects should be in place, following art. 33 and 34 GDPR.

text: December 2017

text: The organization should establish the main procedures and controls to be followed in order to ensure the

text: A. 17 Information security

text: required level of continuity and Business continuity H.1 aspects of business continuity availability of the IT system

text: management

text: processing personal data (in the event of an incident/personal data breach).

text: The organization should ensure that all employees understand their responsibilities and obligations related to the processing of personal Confidentiality of personnel I.1 A.7 Human resource security data. Roles and responsibilities should be clearly communicated during the pre-employment and/or induction process.

text: The organization should ensure that all employees are adequately informed about the security controls of the IT system that relate to their everyday work. Employees involved A.7.2.2 Information security Training J.1 in the processing of personal data awareness, education and should also be properly informed training about relevant data protection requirements and legal obligations through regular awareness campaigns.

text: An access control system applicable to all users accessing the IT system Access control and authentication K.1 should be implemented. The system A.9 Access control should allow creating, approving, reviewing and deleting user accounts.

text: The use of common user accounts should be avoided. In cases where this is necessary, it should be ensured Access control and authentication K.2 A.9 Access control that all users of the common account have the same roles and responsibilities.

text: An authentication mechanism should be in place, allowing access to the IT system (based on the access control policy and system). As a minimum a Access control and authentication K.3 A.9 Access control username/password combination should be used. Passwords should respect a certain (configurable) level of complexity.

text: The access control system should have the ability to detect and not Access control and authentication K.4 allow the usage of passwords that A.9 Access control don’t respect a certain (configurable) level of complexity.

text: December 2017

text: Log files should be activated for each system/application used for the Logging and monitoring L.1 processing of personal data. They A.12.4 Logging and monitoring should include all types of access to data (view, modification, deletion).

text: Log files should be timestamped and adequately protected against Logging and monitoring L.2 tampering and unauthorized access. A.12.4 Logging and monitoring Clocks should be synchronised to a single reference time source

text: Database and applications servers should be configured to run using a Server/Database security M.1 A. 12 Operations security separate account, with minimum OS privileges to function correctly.

text: Database and applications servers should only process the personal data Server/Database security M.2 that are actually neededs to process A. 12 Operations security in order to achieve its processing purposes.

text: Users should not be able to A. 14.1 Security requirements Workstation security N.1 deactivate or bypass security settings. of information systems

text: Anti-virus applications and detection

text: A. 14.1 Security requirements

text: Workstation security N.2 signatures should be configured on a

text: of information systems

text: weekly basis.

text: Users should not have privileges to

text: A. 14.1 Security requirements

text: Workstation security N.3 install or deactivate unauthorized

text: of information systems

text: software applications.

text: The system should have session time-

text: A. 14.1 Security requirements

text: Workstation security N.4 outs when the user has not been

text: of information systems

text: active for a certain time period.

text: Critical security updates released by

text: A. 14.1 Security requirements

text: Workstation security N.5 the operating system developer

text: of information systems

text: should be installed regularly.

text: Whenever access is performed through the Internet, communication Network/Communication security O.1 A.13 Communications Security should be encrypted through cryptographic protocols (TLS/SSL).

text: Backup and data restore procedures should be defined, documented and Back-ups P.1 A.12.3 Back-Up clearly linked to roles and responsibilities.

text: Backups should be given an appropriate level of physical and Back-ups P.2 environmental protection consistent A.12.3 Back-Up with the standards applied on the originating data.

text: Execution of backups should be Back-ups P.3 A.12.3 Back-Up monitored to ensure completeness.

text: December 2017

text: Full backups should be carried out Back-ups P.4 A.12.3 Back-Up regularly.

text: Mobile and portable device

text: management procedures should be A. 6.2 Mobile devices and Mobile/Portable devices Q.1 defined and documented establishing teleworking

text: clear rules for their proper use.

text: Mobile devices that are allowed to

text: A. 6.2 Mobile devices and

text: Mobile/Portable devices Q.2 access the information system should

text: teleworking

text: be pre-registered and pre-authorized.

text: Mobile devices should be subject to

text: the same levels of access control A. 6.2 Mobile devices and Mobile/Portable devices Q.3 procedures (to the data processing teleworking

text: system) as other terminal equipment.

text: During the development lifecycle best

text: A.12.6 Technical vulnerability

text: practises, state of the art and well

text: management & A.14.2 Security

text: Application lifecycle security R.1 acknowledged secure development

text: in development and support

text: practices, frameworks or standards

text: processes

text: should be followed.

text: A.12.6 Technical vulnerability

text: Specific security requirements should

text: management & A.14.2 Security

text: Application lifecycle security R.2 be defined during the early stages of

text: in development and support

text: the development lifecycle.

text: processes

text: Specific technologies and techniques

text: designed for supporting privacy and A.12.6 Technical vulnerability

text: data protection (also referred to as management & A.14.2 Security Application lifecycle security R.3 Privacy Enhancing Technologies in development and support

text: (PETs)) should be adopted in analogy processes

text: to the security requirements.

text: A.12.6 Technical vulnerability

text: Secure coding standards and management & A.14.2 Security Application lifecycle security R.4 practises should be followed. in development and support

text: processes

text: During the development, testing and A.12.6 Technical vulnerability

text: validation against the management & A.14.2 Security Application lifecycle security R.5 implementation of the initial security in development and support

text: requirements should be performed. processes

text: Software-based overwriting should

text: be performed on all media prior to

text: A. 8.3.2 Disposal of media & A.

text: their disposal. In cases where this is Data deletion/disposal S.1 11.2.7 Secure disposal or renot possible (CD’s, DVD’s, etc.)

text: use of equipment

text: physical destruction should be

text: performed.

text: Shredding of paper and portable A. 8.3.2 Disposal of media & A.

text: Data deletion/disposal S.2 media used to store personal data 11.2.7 Secure disposal or re-

text: shall be carried out. use of equipment

text: The physical perimeter of the IT

text: system infrastructure should not be A.11 – Physical and Physical security T.1 accessible by non-authorized environmental security

text: personnel.

text: December 2017

text: Proposed Measures for Medium Risk Level

text: RELEVANT MEASURE MEASURE CATEGORY MEASURE DESCRIPTION IDENTIFIER ISO/IEC 27001: 2013 CONTROL

text: The organization should document a separate dedicated security policy with regard to the processing of Security policy and procedures for A.3 personal data. The policy should be A.5 Security policy the protection of personal data approved by management and communicated to all employees and relevant external parties

text: The security policy should at least refer to: the roles and responsibilities of personnel, the baseline technical Security policy and procedures for and organisation measures adopted

text: A.4 A.5 Security policy

text: the protection of personal data for the security of personal data, the data processors or other third parties involved in the processing of personal data.

text: An inventory of specific policies/procedures related to the Security policy and procedures for A.5 security of personal data should be A.5 Security policy the protection of personal data created and maintained, based on the general security policy.

text: Clear appointment of persons in charge of specific security tasks A.6.1.1 Information security Roles and responsibilities B.3 should be performed, including the roles and responsibilities appointment of a security officer.

text: An access control policy should be detailed and documented. The organization should determine in this document the appropriate access Access control policy C.2 A.9.1.1 Access control policy control rules, access rights and restrictions for specific user roles towards the processes and procedures related to personal data.

text: Segregation of access control roles (e.g. access request, access Access control policy C.3 authorization, access administration) A.9.1.1 Access control policy should be clearly defined and documented.

text: Roles having access to certain Resource/asset management D.3 resources should be defined and A.8 Asset management documented.

text: A detailed and documented change policy should be in place. It should include: a process for introducing A. 12.1 Operational Change management E.3 changes, the roles/users that have procedures and change rights, timelines for responsibilities introducing changes. The change policy should be regularly updated.

text: December 2017

text: MEASURE RELEVANT MEASURE CATEGORY MEASURE DESCRIPTION IDENTIFIER ISO/IEC 27001: 2013 CONTROL

text: The data controller’s organization should regularly audit the compliance Data processors F.4 of the data processor to the agreed A.15 Supplier relationships level of requirements and obligations.

text: The incidents’ response plan should Incidents handling / Personal data be documented, including a list of A.16 Information security

text: breaches possible mitigation actions and clear incident management assignment of roles.

text: A BCP should be detailed and

text: A. 17 Information security

text: documented (following the general Business continuity H.2 aspects of business continuity security policy). It should include

text: management

text: clear actions and assignment of roles.

text: A level of guaranteed service quality

text: A. 17 Information security

text: should be defined in the BCP for the Business continuity H.3 aspects of business continuity core business processes that provide

text: management

text: for personal data security.

text: Prior to up taking their duties employees should be asked to review and agree on the security policy of Confidentiality of personnel I.2 A.7 Human resource security the organization and sign respective confidentiality and non-disclosure agreements.

text: The organization should have structured and regular training

text: A.7.2.2 Information security

text: programmes for staff, including Training J.2 awareness, education and specific programmers for the

text: training

text: induction (to data protection matters) of newcomers.

text: A specific password policy should be defined and documented. The policy should include at least password Access control and authentication K.5 A.9 Access control length, complexity, validity period, as well as number of acceptable unsuccessful login attempts.

text: User passwords must be stored in a Access control and authentication K.6 A.9 Access control “hashed” form.

text: Actions of the system administrators and system operators, including Logging and monitoring L.3 A.12.4 Logging and monitoring addition/deletion/change of user rights should be logged.

text: There should be no possibility of deletion or modification of log files content. Access to the log files should Logging and monitoring L.4 A.12.4 Logging and monitoring also be logged in addition to monitoring for detecting unusual activity.

text: A monitoring system should process Logging and monitoring L.5 A.12.4 Logging and monitoring the log files and produce reports on

text: December 2017

text: the status of the system and notify for potential alerts.

text: Encryption solutions should be considered on specific files or records Server/Database security M.3 A. 12 Operations security through software or hardware implementation.

text: Encrypting storage drives should be Server/Database security M.4 A. 12 Operations security considered

text: Pseudonymization techniques should be applied through separation of Server/Database security M.5 data from direct identifiers to avoid A. 12 Operations security linking to data subject without additional information

text: Anti-virus applications and detection

text: A. 14.1 Security requirements

text: Workstation security N.6 signatures should be configured on a

text: of information systems

text: daily basis.

text: Wireless access to the IT system should be allowed only for specific Network/Communication security O.2 users and processes. It should be A.13 Communications Security protected by encryption mechanisms.

text: Remote access to the IT system should in general be avoided. In cases where this is absolutely necessary, it should be performed only under the Network/Communication security O.3 A.13 Communications Security control and monitoring of a specific person from the organization (e.g. IT administrator/security officer) through pre-defined devices.

text: Traffic to and from the IT system should be monitored and controlled Network/Communication security O.4 A.13 Communications Security through Firewalls and Intrusion Detection Systems.

text: Backup media should be regularly Back-ups P.5 tested to ensure that they can be A.12.3 Back-Up relied upon for emergency use.

text: Scheduled incremental backups Back-ups P.6 should be carried out at least on a A.12.3 Back-Up daily basis.

text: Copies of the backup should be Back-ups P.7 A.12.3 Back-Up securely stored in different locations.

text: In case a third party service for back up storage is used, the copy must be Back-ups P.8 A.12.3 Back-Up encrypted before being transmitted from the data controller.

text: Specific roles and responsibilities A. 6.2 Mobile devices and Mobile/Portable devices Q.4 regarding mobile and portable device teleworking

text: December 2017

text: management should be clearly

text: defined.

text: The organization should be able to

text: remotely erase personal data

text: A. 6.2 Mobile devices and

text: Mobile/Portable devices Q.5 (related to its processing operation)

text: teleworking

text: on a mobile device that has been

text: compromised.

text: Mobile devices should support

text: separation of private and business A. 6.2 Mobile devices and Mobile/Portable devices Q.6 use of the device through secure teleworking

text: software containers.

text: Mobile devices should be physically

text: A. 6.2 Mobile devices and

text: Mobile/Portable devices Q.7 protected against theft when not in

text: teleworking

text: use.

text: Vulnerability assessment, application

text: and infrastructure penetration

text: A.12.6 Technical vulnerability

text: testing should be performed by a

text: management & A.14.2 Security

text: Application lifecycle security R.6 trusted third party prior to the

text: in development and support

text: operational adoption. The application

text: processes

text: shall not be adopted unless the

text: required level of security is achieved.

text: A.12.6 Technical vulnerability

text: Periodic penetration testing should management & A.14.2 Security Application lifecycle security R.7 be carried out. in development and support

text: processes

text: A.12.6 Technical vulnerability

text: Information about technical

text: management & A.14.2 Security

text: Application lifecycle security R.8 vulnerabilities of information systems

text: in development and support

text: being used should be obtained.

text: processes

text: Software patches should be tested A.12.6 Technical vulnerability

text: and evaluated before they are management & A.14.2 Security Application lifecycle security R.9 installed in an operational in development and support

text: environment. processes

text: Multiple passes of software-based A. 8.3.2 Disposal of media & A.

text: Data deletion/disposal S.3 overwriting should be performed on 11.2.7 Secure disposal or re-

text: all media before being disposed. use of equipment

text: If a third party’s services are used to

text: securely dispose of media or paper

text: A. 8.3.2 Disposal of media & A.

text: based records, a service agreement Data deletion/disposal S.4 11.2.7 Secure disposal or reshould be in place and a record of

text: use of equipment

text: destruction of records should be

text: produced as appropriate.

text: Clear identification, through

text: appropriate means e.g. ID Badges, for

text: all personnel and visitors accessing A.11 – Physical and Physical security T.2 the premises of the organization environmental security

text: should be established, as

text: appropriate.

text: December 2017

text: Secure zones should be defined and

text: be protected by appropriate entry

text: controls. A physical log book or A.11 – Physical and Physical security T.3 electronic audit trail of all access environmental security

text: should be securely maintained and

text: monitored

text: Intruder detection systems should be A.11 – Physical and Physical security T.4 installed in all security zones. environmental security

text: Physical barriers should, where

text: A.11 – Physical and

text: Physical security T.5 applicable, be built to prevent

text: environmental security

text: unauthorized physical access.

text: Vacant secure areas should be

text: A.11 – Physical and

text: Physical security T.6 physically locked and periodically

text: environmental security

text: reviewed

text: An automatic fire suppression

text: system, closed control dedicated air

text: conditioning system and A.11 – Physical and Physical security T.7 uninterruptible power supply (UPS) environmental security

text: should be implemented at the server

text: room

text: External party support service

text: A.11 – Physical and

text: Physical security T.8 personnel should be granted

text: environmental security

text: restricted access to secure areas.

text: Proposed Measures for High Risk Level

text: The security policy should be Security policy and procedures for the A.6 reviewed and revised, if necessary, A.5 Security policy protection of personal data on a semester basis.

text: The security officer should be

text: formally appointed (documented).

text: A.6.1.1 Information security

text: Roles and responsibilities B.4 The tasks and responsibilities of the

text: roles and responsibilities

text: security officer should also be

text: clearly set and documented.

text: Conflicting duties and areas of

text: responsibility, for examples the

text: roles of security officer, security

text: auditor, and DPO, should

text: A.6.1.1 Information security

text: Roles and responsibilities B.5 considered to be segregated to

text: roles and responsibilities

text: reduce opportunities for

text: unauthorized or unintentional

text: modification or misuse of personal

text: data.

text: December 2017

text: Roles with excessive access rights should be clearly defined and Access control policy C.4 A.9.1.1 Access control policy assigned to limited specific members of staff.

text: IT resources should be reviewed Resource/asset management D.4 A.8 Asset management and updated on annual basis.

text: The employees of the data processor who are processing personal data should be subject to Data processors F.5 A.15 Supplier relationships specific documented confidentiality/ non-disclosure agreements.

text: Incidents and personal data breaches should be recorded along Incidents handling / Personal data A.16 Information security G.4 with details regarding the event breaches incident management and subsequent mitigation actions performed.

text: Specific personnel with the necessary responsibility, authority

text: A. 17 Information security

text: and competence to manage Business continuity H.4 aspects of business continuity business continuity in the event of

text: management

text: an incident/personal data breach should be nominated.

text: An alternative facility should be

text: A. 17 Information security

text: considered, depending on the Business continuity H.5 aspects of business continuity organization and the acceptable

text: management

text: downtime of the IT system.

text: Employees involved in high risk processing of personal data should Confidentiality of personnel I.3 be bound to specific confidentiality A.7 Human resource security clauses (under their employment contract or other legal act).

text: A training plan with defined goals A.7.2.2 Information security Training J.3 and objectives should be prepared awareness, education and and executed on an annual basis. training

text: Two-factor authentication should preferably be used for accessing systems that process personal data. Access control and authentication K.7 The authentication factors could be A.9 Access control passwords, security tokens, USB sticks with a secret token, biometrics etc.

text: Device authentication should be used to guarantee that the Access control and authentication K.8 processing of personal data is A.9 Access control performed only through specific resources in the network.

text: Techniques supporting privacy at Server/Database security M.6 A. 12 Operations security the database level, such as

text: December 2017

text: authorized queries, privacy preserving data base querying, searchable encryption, etc., should be considered.

text: It should not be allowed to transfer personal data from workstations to A. 14.1 Security requirements Workstation security N.7 external storage devices (e.g. USB, of information systems DVD, external hard drives).

text: Workstations used for the processing of personal data should preferably not be connected to the Internet unless security measures A. 14.1 Security requirements Workstation security N.8 are in place to prevent of information systems unauthorised processing, copying and transfer of personal data on store.

text: Full disk encryption should be

text: A. 14.1 Security requirements

text: Workstation security N.9 enabled on the workstation

text: of information systems

text: operating system drives

text: Connection to the internet should not be allowed to servers and Network/Communication security O.5 A.13 Communications Security workstations used for the processing of personal data.

text: The network of the information system should be segregated from Network/Communication security O.6 A.13 Communications Security the other networks of the data controller.

text: Access to the IT system should be performed only by pre-authorized Network/Communication security O.7 devices and terminal using A.13 Communications Security techniques such as MAC filtering or Network Access Control (NAC)

text: Copies of backups should be Back-ups P.9 encrypted and securely stored A.12.3 Back-Up offline as well.

text: Two factor authentication should

text: A. 6.2 Mobile devices and

text: Mobile/Portable devices Q.8 be considered for accessing mobile

text: teleworking

text: devices

text: Personal data stored at the mobile device (as part of the organization’s A. 6.2 Mobile devices and Mobile/Portable devices Q.9 data processing operation) should teleworking be encrypted.

text: Following the software erasure, additional hardware based

text: A. 8.3.2 Disposal of media & A.

text: measures such as degaussing Data deletion/disposal S.5 11.2.7 Secure disposal or reshould be performed. Depending

text: use of equipment

text: on the case, physical destruction should also be considered.

text: December 2017

text: If a third party, therefor data processor, is being used for destruction of media or paper

text: A. 8.3.2 Disposal of media & A.

text: based files, it should be considered Data deletion/disposal S.6 11.2.7 Secure disposal or rethat the process takes place at the

text: use of equipment

text: premises of the data controller (and avoid off-site transfer of personal data.

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece TP-02-18-047-EN-N PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-251-6 DOI: 10.2824/569768 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu