The LOPD and the physical security of facilities

The LOPD or Data Protection Law and the General Data Protection Regulation (GDPR) establish the rules and regulations for the processing of personal data of customers, employees and other individuals by companies and organizations. These European and Spanish data protection regulations impose requirements for the privacy and security of this data and establish sanctions for those companies that do not comply with their obligations.

Physical security is the set of measures implemented to protect the equipment, resources and other assets of a facility, ensuring that only authorized personnel can access them.

Physical Security is essential to guarantee the integrity of the assets of a company or institution, and to prevent unauthorized access or theft, and is closely related to the General Data Protection Regulation.

Vulnerabilities for the LOPD in facilities physical

Since the entry into force of the General Data Protection Regulation(GDPR), companies must comply with certain security measures to avoid sanctions. These measures are not defined in a general way, but are established according to the risk detected. In other words, companies must assess the risks to which their employees are exposed. processing of personal data and establish security measures proportional to that risk.

Security measures established by the LOPD

When determining the security measures required to comply with the General Data Protection Regulation (GDPR), we can classify them into two categories: organizational measures and technical measures. Organizational measures refer to the company’s data protection structure and policies, while technical measures include IT security tools and systems to protect data. Both are important to ensure information security and comply with data protection regulations.

Organizational measures

It is important that employees are aware of and comply with the organizational security measures established by the General Data Protection Regulation(GDPR). Some of these measures include:

–Preventunauthorized access to personal data, which can be done by logging off computers and not leaving papers with data in unsupervised places.

–Storedocuments with personal data in secure physical media, either in paper or electronic format.

–Destroydocuments with personal information before discarding them.

Not toprovide personal data to third parties, either through telephone calls or e-mails.

–Notifythe Spanish Data Protection Agency in case of breach of personal data security.

Technical measures

Within the technical security measures established by the General Data Protection Regulation(GDPR), there are two fundamental blocks. The identification of users and the duty to safeguard.

When it comes to user identification, secure passwords are essential for accessing personal data. These passwords should be alphanumeric and at least 12 characters long. In addition, if several people have access to the data, each person should have his or her own user name and password. To protect the system, it is advisable to use an administrator profile for system configuration and to prevent other users from having privileges. Passwords should be kept confidential and not shared, and should not be written down or left in plain view.

As for measures to safeguard data, it is important:

–Keepingdevices up to date, both computers and cell phones.

–Ensuredata confidentiality when transferring data, either by encryption or physical means.

–Createa backup copy periodically and store it in a safe place different from the usual data.

-Firewall toprevent unauthorized access or computer attacks.

–Installan antivirus program to protect personal data.

Ensuring the physical security of the facilities

To ensure the physical security of the facilities and compliance with the data protection law (LOPD and RGPD), it is important to hire security personnel, place high quality locks, install security systems and surveillance cameras if necessary, and establish policies and procedures for access to the facilities.

It is necessary to have a contingency plan to deal with emergency situations, including natural disasters or accidents. The recording of physical security incidents in order to identify possible weaknesses and implement corrective measures to strengthen current measures.

It is also essential that all personnel are informed and trained on security measures and compliance with the Data ProtectionLaw (LOPD) and the European Data Protection Regulation(GDPR).

Business Adapter® at your service

If you want us to help you to comply with this obligation or to fully comply with the European and Spanish data protection regulations (RGPD + LOPD) to which any company or professional is obliged, contact us by email: info@businessadapter.es, you can also call 96 131 88 04, or leave your message in this form:

[su_button url=”https://businessadapter.es/contacto” target=”blank” background=”#f6f903″ color=”#181818″ size=”7″ center=”yes” icon_color=”#000000″]Contact us, we will be pleased to help you.[/su_button]