As a data controller, how can you guarantee the protection of personal data?

The General Data Protection Regulation (GDPR) states that "all processing of personal data must be lawful and fair". The data controller must inform the persons concerned "of the risks, rules, guarantees and rights associated with the processing" and "guarantee appropriate security and confidentiality".

To this end, the Principal must keep a register recording the lawfulness of data processing and the measures taken to guarantee the security of processed data.

In particular, he/she must guarantee:

• the physical security of the server where processing takes place,
• the protection of data, which must be accessible only to authorized persons,
• the security of computer and electronic communication systems,
• the ability to restore server availability within an appropriate timeframe in the event of an incident.