7. Ensure the security of processing
The hobby organiser must take care of the protection of data at all stages of processing from collection to erasure. Secure processing requires that the controller is able to guarantee the confidentiality, integrity, usability and resilience of the systems and services at all times and is able to restore the data quickly in the event of a fault. The processing of personal data must also be monitored and supervised to ensure security.
The adequate level of data security depends on the nature and volume of the data being processed. For example, sensitive data and special categories of personal data require more effective technical safeguards. Large volumes of data can attract interest from outside parties and thus require more effective safeguards. Personal data must be secured at all stages of processing, that is, from collection to erasure.
Data must be protected from access by third parties. ‘Third parties’ means everyone without a basis or right to process the personal data.
In electronic systems, third-party access to personal data can be prevented with access rights management. The controller must ensure that only persons whose duties give them the right to process personal data can gain access to the data. Remember that viewing the data also counts as processing. When a person changes roles within the club, you should also remember to immediately deactivate their access rights to systems they are no longer entitled to access.
You should use individual usernames in your systems. The use of shared usernames is not recommended. With individual usernames, the controller can control and verify the processors of personal data, including retrospectively.
The controller must check the default settings of new systems and applications before starting to use them. With regard to data protection, you should check that all users cannot see personal data by default.
