NIST Privacy Framework, Control-PCT.DM-P8

Allow access only to users on the basis of user roles, authentication and authorization, keep audit records of all activity in the system, and require strong passwords of at least 16 characters (Article 8).

Keep backup copies of the health data in your Provider Bank and log any recovery of data from backups, so that the nature and extent of any data loss can be assessed (Article 27, paragraph 1, point (d)).

Log every access to the Electronic Health Record with at least the date and time, a unique transaction number, the type of processing, the unique identifier of the person accessing, the identifier of the data used, the search criteria and any error messages (Article 32).

If several people work in the facility, create a rights and roles concept so that only authorized persons can further process the data and each further processing is logged (Section 6, paragraph 1).

Apply the measures Article 181-3 lists: a data protection officer, impact assessments, anonymization, pseudonymization or functional separation, encryption in transit with state-of-the-art key management, access restrictions, logging of the reason, date, time and person for each access, staff awareness, regular independent audit, sectoral codes of conduct and an internal policy on the principles of GDPR Article 5 (Article 181-3, paragraph 1, point 2).

Never derogate from the encryption, access restriction, logging, staff awareness and internal policy measures (Article 181-3, paragraph 3).

Where you process sensitive or health data, put in place the heightened technical measures Article 24 lists: control who can enter the processing facility, who can read, copy, modify, or remove the data media, and who can access, transmit, or input the data, and keep a record of what sensitive data was input, when, and by whom.

Maintain, or require the maintenance of, an electronic audit log that records, for every instance in which personal health information accessible by electronic means is viewed, handled, modified or otherwise dealt with, the type of information, the date and time, the identity of every person who dealt with it and the identity of the individual it relates to.

Audit and monitor the log as often as the regulations require, comply with any prescribed requirements, and give the Commissioner a copy of the log on request, even where it contains personal health information.

As a health information network provider, keep, to the extent reasonably practical, an electronic record of all accesses to and transfers of custodians' information in equipment you control, identifying who accessed or transferred it and when, and make it available to a custodian on request.

Put in place the special safety measures the Law requires of a controller that processes sensitive data under Article 7(2) or keeps records of suspected unlawful activity under Article 8: control of premises entry, data-carrier handling, unauthorized disclosure, system access, transmission, and data-entry logging, and keep health and sex-life data logically separated from other personal data.

Lay down procedures and use tools to monitor and log activities on your network and information systems, maintain, document and review the logs, and establish a list of the assets to be subject to logging based on your risk assessment. Where appropriate, include in the logs network traffic, changes to users and permissions, access to systems and applications, authentication events, privileged and administrator activity, access to or changes of critical configuration and backup files, security tool logs, use of system resources, physical access, use of network equipment, and the activation, stopping and pausing of logs, and environmental events. Review the logs regularly for unusual or unwanted trends and start a qualified response in a timely manner when an alarm is triggered. Maintain and back up the logs for a predefined period, protect them from unauthorized access or changes, and, to the extent feasible, synchronize the time sources of all systems and make your monitoring and logging systems redundant (points 3.2.1 and 3.2.3 to 3.2.6).

Develop, document and implement logging procedures, protocols and tools that identify the events to be logged and the retention period (set it taking into account your business and information security objectives, the reason for recording the event in the logs and the results of your ICT risk assessment), log events related to access control, identity management, capacity management, change management, ICT operations and network traffic, protect logs against tampering, deletion and unauthorized access, detect failures of logging systems, and synchronize the clocks of your ICT systems to a documented reliable reference time source (Article 12).

Ensure secure identification when communicating between the payer's device and the payee's acceptance devices for electronic payments, and effectively mitigate the risks of misdirection of communication to unauthorized parties in mobile applications and other interfaces offering electronic payment services. Have processes that make all payment transactions and other interactions traceable, with a unique identifier of each communication session, detailed logging of the transaction and timestamps synchronized according to an official time signal (Articles 28 and 29).

Comply with the national cybersecurity authority's directives on retaining, for one year from generation, the technical data needed to identify a cybersecurity incident, including connection data, system logs, and the security-event traces your operating systems, applications and security products generate.

Implement risk-based policies, procedures and controls designed to monitor the activity of authorized users (any employee, contractor, agent or other person that participates in your business operations and is authorized to access and use your information systems and data) and to detect unauthorized access or use of, or tampering with, nonpublic information by those authorized users.

Keep a written or electronic record of your processing activities and an automated log of processing operations, and make each available to the ANPDP on request.

As a network service provider or data host, keep the traffic data of everyone using your service, the data that identifies them and the other technical data of their communications for three years from the service delivery date, keep it under professional secrecy, and produce it to the judicial police or the court when the competent judicial authority so decides.

As a data host, store for ten years the identification data of a non-professional who makes information available online to the public anonymously.

Log every collection, alteration, access, disclosure, combination and erasure of personal data, and maintain a record of all processing activities, producing both to the supervisory authority on request.

Take all necessary precautions to secure personal data against unauthorized modification, alteration or consultation, including physical access controls, a log of who accessed the system and when, and secure backup copies.

Retain your systems' connection and traffic data for ten years, and submit your networks and information systems to a mandatory, periodic security audit on terms a regulation sets.

At the medium or high tier, run an automatic mechanism monitoring access to the database's systems, retained at least 24 months, and appoint a data security officer where required.

Adopt rules for handling data, log who has accessed it, and oversee the security of that data (Article 12).

Complete a personal-information-protection impact assessment before deploying automated decision-making, and keep the assessment report and the processing record for at least three years.

To verify whether a person qualifies as a user, do not require that person to provide any information beyond what is necessary, and do not keep any information, in particular log data, on the user's access to the data requested beyond what is necessary for the sound execution of the user's access request and for the security and maintenance of the data infrastructure (Article 4(5)).

To verify whether a person qualifies as a user or as a third party, do not require that person to provide any information beyond what is necessary, and do not keep any information on the third party's access to the data requested beyond what is necessary for the sound execution of the third party's access request and for the security and maintenance of the data infrastructure (Article 5(4)).

Keep your advertising and scripts, prize-recipient records, customer and sales records, telemarketing employee records, and payment authorizations for 24 months.

Keep telemarketing records, including scripts, prerecorded messages, and call logs, for five years.

Retain seven years of anonymized age verification data.

For a remote biometric identification system, log the start and end date and time of each use, the reference database checked, the input data that produced a match, and the identity of the person who verified the result.

Document every use in the relevant police file, and make it available to the market surveillance authority and the national data protection authority on request, excluding sensitive operational data.

Have the European logging software component of an EHR system designed to enable access to personal electronic health data record at least, on every access event or group of events, the identification of the healthcare provider or other individuals who accessed the data, the identification of the specific natural person or persons who accessed it, the categories of data accessed, the time and date of access and the origin or origins of the data (Annex II, point 3.2).

Include in the harmonised software components tools or mechanisms to review and analyze the log data, or support the connection and use of external software for the same purposes, and support different retention periods and access rights that take into account the origins and categories of electronic health data (Annex II, points 3.3 and 3.4).