Technical and organizational measures
TOMs for Data Protection
Technical and Organizational Measures (TOMs) are guidelines that personal data that is processed, collected or used must follow to meet the security and protection requirements of the GDPR.
What is it anyway?
Technical and organizational measures (TOMs) are guidelines that govern the processing, collection, and use of personal data with the aim of meeting the stringent security and protection requirements outlined by the GDPR. TOMs encompasses a variety of subject areas, including physical (alarm systems in buildings), digital (hardware and software) or procedural (dual control principle).
In data protection, TOMs are mainly present in the digital environment. These include user accounts, passwords, data backups, firewalls, virus scanners and biometric user identification.
Why do I need to document this? Why do I need that?
In case there's a serious data breach or violation of data protection rules, TOMs can demonstrate that proper steps were taken to protect the data. It's crucial for the company to document these measures early on, before authorities ask for it. This documentation starts as soon as personal data is being processed, typically when data like email addresses for newsletters or general customer information is collected.
Right after data collection and documentation begin, it's important to make sure that the TOMs align with the needs of the industry. For example, a doctor's office that handles sensitive patient data, like insurance numbers and medical records, needs more robust IT infrastructure security compared to a tradesperson who stores customer data on a platform like Excel. Each situation has different expectations for data protection, and the TOMs should be tailored accordingly to meet these requirements.
What do I need to pay attention to when creating it?
When creating TOMs, it's crucial to consider the different categories involved. We can split them into technical measures and organizational measures. Technical measures cover physical safeguards that ensure the security of data processing, such as locks on windows and doors or alarm systems. On the other hand, organizational measures involve guidelines and procedures for employees to follow, such as visitor registration protocols or the dual control principle. It's worth noting that both types of measures can be found within various control categories, each of which should be documented separately.
These control categories can be divided into access control, access control, separation requirement, input control, disclosure control and availability control.
In accordance with Article 32 (1) of the GDPR, several factors must be considered when introducing technical and organizational measures, such as the current state of the art, implementation costs, and the nature, scope, circumstances and purposes of the processing of personal data. It’s therefore important that the purposeful processing of data is secured, which is why the data processing systems must be highly resilient and there are procedures for recovering personal data after a data loss. Data should always be processed in encrypted and pseudonymous form.
When designing the TOMs, it is imperative to consider the likelihood and the severity of risks to the rights and freedoms of the individuals whose data is being processed.
More articles
The Apple and OpenAI Partnership
Apple's partnership with OpenAI to integrate ChatGPT into Siri marks a significant advancement in AI, promising smarter user interactions. However, it also brings data privacy and compliance challenges. As a data protection company, we explore the implications for businesses and consumers, emphasizing the need for robust compliance frameworks and external validation to ensure trust and transparency.
Learn moreUnderstanding the EU's Digital Services Act: A Guide for Businesses
The EU Digital Services Act (DSA) creates a safer, more transparent digital space and protects user rights. Since December 2020, it has significantly revised the E-Commerce Directive of 2000. The DSA promotes transparency, accountability, tackling illegal content and competition in the digital market. It applies to various digital services in the EU, including network infrastructure providers, hosting services, online platforms, and very large online platforms (VLOPs). Key obligations include transparent reporting, removal of illegal content, user complaint mechanisms, risk assessments, and transparent advertising. Non-compliance can lead to significant fines, sanctions, and reputational damage. Companies should understand their obligations and comply to promote a trustworthy digital ecosystem.
Learn moreCompliance Success: Why Vendor Risk Management is a Must-Have for SMEs
Vendor Risk Management (VRM) is crucial for businesses, ensuring legal compliance, safeguarding sensitive data, and fortifying against cyber threats. VRM mitigates risks associated with third-party vendors, preventing potential legal issues and protecting valuable information. The proactive approach of heyData's VRM solution revolutionizes risk management, offering a comprehensive strategy to stay ahead in the ever-evolving digital landscape. This innovative solution not only enhances security but also streamlines processes, fostering a resilient and compliant business environment. Understand the indispensable role VRM plays and how heyData's solution can transform your risk management strategy effectively.
Learn more