• 

  What security measures need to be put in place if the institution chooses to use its own physical server (non-hosted mode)?

According to Article 32 of the GDPR (RGPD) on the obligation to secure personal data, all of the following conditions must be guaranteed:

• Users connect to an address starting with https...
• The server is protected against theft and has access control.
• The server is protected against accidental destruction, such as fire.
• There is a back-up infrastructure in case of hardware or electrical failure.
• The server has all its software updates.
• The server is not used for other functions.
• Data and logs are backed up daily on separate media.
• The quality and speed of the server's Internet connection are guaranteed at all times.
• Network equipment protects user data in the event of computer attacks.