Security (technical & organizational)
Measures under Art. 32 GDPR must match the risk of processing. Health data usually require stronger safeguards.
Access control
- Authentication for user accounts (e.g. password, MFA where possible)
- Role and permission models (who may see which customer data?)
- Logging of security-relevant access, where proportionate
Encryption
- Transport encryption (HTTPS/TLS) for the application
- Storage encryption or comparable safeguards at infrastructure level, as provided and contractually assured by the vendor
System architecture
- Separation of production and test environments
- Tenant separation on multi-tenant platforms
- Hardening and regular updates of components (responsibility of practice vs. platform per agreement)
Export & disclosure
- Exports of data only with clear authorization and purpose limitation
- Disclosure to third parties only on a legal basis and with a data transfer / processing agreement for processors
Risks & safeguards
- Staff training (phishing, secure logout, no sharing of credentials)
- Incident response (data breach handling) in contracts and internal policies
