GDPR
General Data Protection Regulation (EU 2016/679)
Le règlement européen encadrant le traitement des données à caractère personnel. Ses articles relatifs à la sécurité et à la responsabilité (notamment art. 5, 25, 30, 32–35) correspondent directement aux mesures techniques et organisationnelles des cadres de sécurité.
Who it applies to
Toute organisation, où qu'elle soit dans le monde, qui traite les données personnelles de personnes situées dans l'UE/EEE — qu'elle soit établie dans l'UE ou qu'elle propose des biens et services à ces personnes ou surveille leur comportement.
Chapter II — Principles
Chapter IV — Controller and processor
- Art. 25 Data protection by design and by default10 mapped
Implement appropriate technical and organizational measures to embed data-protection principles by design and by default.
- Art. 30 Records of processing activities6 mapped
Maintain a record of processing activities under the controller's or processor's responsibility.
- Art. 32 Security of processing21 mapped
Implement appropriate technical and organizational measures — including encryption, confidentiality, integrity, availability and resilience — to ensure a level of security appropriate to the risk.
- Art. 33 Notification of a personal data breach to the supervisory authority13 mapped
Notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours.
- Art. 35 Data protection impact assessment
Carry out an assessment of the impact of processing operations that are likely to result in a high risk to individuals' rights and freedoms.