DSGVO
GDPR in IT practice: the key obligations
The General Data Protection Regulation has applied since 2018, yet it remains a recurring topic in many IT departments. This is less due to new rules than to systems, cloud services and processes changing constantly. Data protection is therefore not a one-off task but part of operations.
Records of processing activities
The record under Art. 30 GDPR describes which personal data is processed for which purpose in which systems. For IT it is also a valuable map: if you know where data lives, you can protect it and delete it.
Data processing agreements
Every external service provider that processes personal data on your behalf needs a data processing agreement. This applies to cloud platforms as well as maintenance providers. With providers outside the EU, questions about third-country transfers come on top.
Technical and organisational measures
Art. 32 GDPR requires a level of protection appropriate to the risk. Typical building blocks are:
- access concepts based on the principle of least privilege
- encryption of storage media and transmissions
- backups with tested restores
- logging and regular review
Do not forget deletion
Data may only be stored for as long as its purpose requires. A deletion concept sets retention periods and governs how deletion is carried out in backups and archives as well. Without technical support, this obligation often remains theoretical.
Data protection impact assessment
Processing that is likely to result in a high risk, such as extensive monitoring or the use of new technologies, requires a data protection impact assessment in advance. IT provides the technical evaluation for it.
Documenting these building blocks properly creates not only legal certainty but also a good foundation for NIS-2 and other requirements.