GDPR for IT in GxP companies: records, processors, measures
The part of the GDPR that lands on the IT department's desk, and how to keep it next to the validation records of the same systems instead of in a separate spreadsheet.
What falls to IT
The GDPR (Regulation (EU) 2016/679) binds the whole company, but a good part of it is implemented, documented or contracted for by IT: the systems that process personal data, the service providers that host them, the measures that protect them, and the first hours after something goes wrong.
- Records of processing activities (Art. 30): which system processes which personal data, for what purpose, on which legal basis, for how long
- Processors (Art. 28): an agreement with every service provider that processes personal data for you, including transfers outside the EU
- Technical and organisational measures (Art. 32, 25): encryption, access control, backups, testing, data protection by design and by default
- Data protection impact assessment (Art. 35) where processing is likely to result in a high risk
- Personal data breaches (Art. 33, 34): assessment and, where required, notification to the supervisory authority within 72 hours
- Data subject requests (Art. 12, 15–21): access, rectification, erasure, restriction and portability, within one month
Why it belongs next to validation
In a GxP company the same systems carry both obligations: a laboratory system holds personal data of employees and sometimes of trial participants, the ERP holds customer contacts, the provider hosting the quality system is a processor. A breach is often first an IT incident. Keeping the data protection records linked to the same system records avoids two inventories that disagree.
With the GxP Validation Assistant
How the assistant supports it
Seven record types
Processing activities, processors, technical and organisational measures, impact assessments, breaches, data subject requests and confidentiality undertakings, each with its document.
Linked to systems
Personal data are a fact of each system; activities, processors and breaches point at the systems they concern, and a breach at the incident it came from.
Deadlines
The 72-hour notification deadline, the one-month response to a request and the review dates of every record appear on the Today page.
One triage
An incident is assessed once for GxP, security and privacy impact, so a personal data breach is not missed in an IT ticket.
The data protection overlay is part of the EU package. It covers IT's part of the GDPR; its agreements are templates to be checked by your data protection officer or legal counsel.
See it with your own systems.
Watch the webinar, or install the assistant and try it for 14 days.