GDPR compliance

The principle of accountability of the GDPR obliges organizations and enterprises to be compliant in requirements for IT security and data protection. Rohde & Schwarz Cybersecurity offers a broad portfolio of IT security solutions. This includes solutions for secure endpoints, networks, clouds and web applications. The latter supports the technical implementation of the GDPR in enterprises.

Article 24 of the GDPR states that technical and organizational measures for data protection are to be taken. The supervisory authority can demand proof of the measures taken. According to Article 32, organizations must take measures to ensure an adequate level of protection. They need to consider state of the art technology as well as the implementation costs. Additionally, the nature, circumstances and purpose of the data processing are relevant. Organizations need to be prepared for the probability and severity of a data protection incident.

For companies: Double-opt-in procedure and complete archiving or documentation of consent, for example, to receive company newsletters.

Companies must carefully review and, if necessary, make software and database corrections to ensure that only data essential to electronic processing or processes (e.g. in HR) is collected.

IT departments need to define a deletion of data by a process that is clear and transparent for all parties involved. This can include, for example, application documents at the end of the application process.

Processes must be clear and focused on the topic of security and data protection. Companies might be obliged to provide evidence at very short notice and must document data processing processes accordingly.

Good documentation is also mandatory here, so that companies can react to these questions in accordance with the law.