Security of processing

Security of processing is the obligation in Art. 32 GDPR for the controller and the processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risks to individuals. It gives effect to the integrity and confidentiality principle of Art. 5(1)(f).

Art. 32(1) lists measures "as appropriate": pseudonymisation and encryption of personal data; the ability to ensure ongoing confidentiality, integrity, availability and resilience of systems; the ability to restore availability and access in a timely manner after an incident; and a process for regularly testing, assessing and evaluating the effectiveness of the measures. Adherence to an approved code of conduct or certification may be used to demonstrate compliance (Art. 32(3)), and controllers and processors must ensure that persons acting under their authority process data only on instructions (Art. 32(4)).

For health data, supervisory authorities expect a mature information security management system: ISO/IEC 27001 certification or equivalent, role-based access control and multi-factor authentication, encryption at rest and in transit, logging and monitoring, secure development, vulnerability management, backup and disaster recovery, staff training and vendor oversight. The CNIL's security guide and ENISA's guidance on security measures for health data are frequent references, and the NIS2 Directive adds sector-specific baseline requirements for health entities. Security measures should be described in general terms in the RoPA, assessed per actor in the DPIA and flowed down to processors through Annex II of the DPA; iliomad is itself ISO 27001 certified and assesses vendors' measures as part of its vendor assessment service.