Optional keeping of the Security Policy Document

THE “OPTIONAL” KEEPING OF THE SECURITY POLICY DOCUMENT

Article 45 of Decree-Law no. 5/12 abolished the obligation to keep the Security Policy Document (Documento Programmatico sulla Sicurezza, D.P.S.) introduced by the Privacy Code (Legislative Decree no. 196/03), which was the main minimum security measure provided for in connection with the general obligation to protect personal data. The person obliged to draw up and update the D.P.S. was the data controller processing sensitive or judicial data with the aid of electronic means.

Businesses, professionals, private and public bodies and, in general, anyone who processes personal data (even merely ordinary data, not necessarily sensitive or judicial data) must always structure their organisations so as to comply with the minimum security measures. The rules introduced into our legal system by Legislative Decree no. 196/03 require a number of compliance steps, including:

• the appointment of the data controller;
• the appointment of the data processors;
• the appointment of the persons authorised to process data;
• the appointment of the system administrator;
• the provision of a specific privacy notice on the purposes and methods of data processing;
• the prior request for consent to data processing;
• notification to the Privacy Authority (Garante), where the obligation applies;
• the adoption of suitable security measures, to ensure that personal data are kept and monitored so as to reduce the risk of theft, alteration or loss of the data; unauthorised access by third parties to the premises where they are kept; and processing of data that is not permitted and not in accordance with the law.

The firm remains at your disposal for any further clarification.

Kind regards

signature

Studio Rimoldi