Editor’s Note: The Data Protection Commission (DPC) is the Irish supervisory authority for the General Data Protection Regulation (GDPR). In this recently published guidance note, DPC Ireland shares important information for data controllers and data processors to consider when developing their security policies. This information is also relevant for any entity considering appropriate technical and organizational measures for ensuring personal data security.
Extract from DPC Ireland Guidance Note on Data Security for Controllers
Guidance for Controllers on Data Security*
Data controllers in the private and public sectors hold increasing amounts of personal data on individuals. The decreasing cost of electronic storage and processing has greatly contributed to this. Organizations also increasingly outsource data processing to third party processors to undertake on their behalf. Many organizations also continue to hold large quantities of personal data in manual form – often in off-site locations. The following guidance has been prepared to aid data controllers and processors to ensure they meet their obligations with regard to the security of personal data they process.
Data Collection and Retention Policies
The most effective means of mitigating the risk of lost or stolen personal data is not to hold the data in the first place. Data retention and replication should always be assessed against business needs and minimized, either by not collecting unnecessary data or by deleting data as soon as the need for it has passed. Holding any personal data presents security risks.
Read the Complete Guidance Note (PDF)Data Security Guidance – DPC Ireland – 022020
* Copyrighted information note shared by permission of Regulations on the Re-use of Public Section Information
- The Data Protection Commission (DPC) Ireland
- Considering Data Subject Access Requests? An Irish Guidance Note