Module 2 · Chapter 5

Security Measures: Article 32 for a Processor

A supplier must keep its customers’ data safe at a level that fits the risk. This chapter reads the security list in the contract, and the two measures a shared app needs most.

≈ 7 min read 8-question test

In this chapter

  • What the law asks of a supplier that keeps other people’s data
  • Why one app for many customers needs a wall between them
  • How the supplier’s records and answers must match its security list

5.1Security in one paragraph

Tennerby keeps Corrandale’s staff data in its app. The law puts the duty to keep that data safe on Tennerby, not only on Corrandale. The steps it takes are its security measures. Some are built into the software, such as encryption, and some are rules for people, such as who may look at what.

The Data Processing Agreement lists them in Schedule 2. That way Corrandale can see what it gets, and Tennerby knows what it must keep up.

Key point

Tennerby must keep Corrandale’s data safe at a level that fits the risk. Schedule 2 of the Agreement lists how it does that.

Also in this chapter

  1. What Article 32 asks of a supplier
  2. Keeping each customer’s data apart
  3. Records, questions and the customer’s risk review
  4. Your job

Preview

The rest of this chapter opens with a free account. Every edition is free to read until 31 January. Open a free account by the end of that day and keep every edition published by then, for good. Open it from the edition home →