The GDPR requires processing activities to be protected by appropriate technical and organizational measures (article 32) and data protection to be built in by design and by default (article 25). MyZapp keeps both in Data protection › Security measures.
Measures detected by the application
At the top of the page, MyZapp shows the measures it detects by itself on the instance:
| Measure | What is checked |
|---|---|
| Application encryption at rest | A data encryption key is in place |
| Chained logs | The integrity of the audit logs can be verified |
| Sensitive data access log | Views of sensitive data are logged |
| Logs anchored outside the database | The logs are anchored in external storage |
| Passwords | The minimum length is at least 12 characters |
| Two-factor authentication | It is required for at least one group |
Each line says whether the measure is in place and whether it is already in your list of measures.
The list of measures
For each legal entity, the data protection officer (or an administrator) describes the measures: category (access control, encryption, backup, training…), status (planned, in place, not applicable), evidence (procedure, document, link), owner, protected processing activities and review interval. A measure can be linked to a detected measure: the screen then shows both side by side.
The Mark as reviewed button dates the review and computes the next one. The dashboard flags planned measures and those due for review.
Data protection by design and by default
At the bottom of the page, each processing activity opens its article 25 review: ten items, three of which are read from the register and cannot be checked by hand:
- a retention period is set;
- at least one security measure in place protects the processing;
- the need for an impact assessment is settled.
The others (minimization, optional fields that can be turned off, access restricted by default, masking on screen, pseudonymized exports, information of the people, exercise of rights) are checked at each review, with notes. Each save adds a dated review; previous ones stay visible. Processing owners can keep these reviews too.