5.5 Organisational measures
Any actor shall be allowed to access, manage, or share, personal or confidential data before the data-protection implementation is documented. The actor must fulfil legal requirements and document how to meet requirements. It could also be valuable to get an independent review of the implementation by an external party. Table 14 describes the steps of implementing the organisational measures:
Table 14: Organisational measures for data protection
Measure | Description |
Data Supervisor | Appoint an individual as Data Supervisor. The Data Supervisor is responsible for mapping, implementing, documenting, and following the requirements for data-protection. |
Data controller and Data Protection Officer | If personal data are included, the organisation (in a European context) handling the data assumes the responsibilities of being a Data Controller and must appoint a Data Protection Officer. |
Legal | Ensure legal compliance with current legislation. |
Documentation | Compile data-protection documentation describing the implementation. |
Ethics | Determining whether the intended data usage requires approval from a national ethics committee. |
Ensure that anyone using or handling data has relevant contracts signed, including non-disclosure agreements.