NIST Privacy Framework, Protect-PPR.AC-P4

Designate the specific staff with access to genetic, biometric, or health data of a person in Belgium, keep that list available to the GBA/APD, and bind those staff to confidentiality, per Act Article 9.

Designate the categories of staff with access to sensitive personal data, keep that list available to the Autorité, and bind them to confidentiality by a legal, statutory, or contractual obligation.

Take the additional information security measures Article 25 lists for special-category and criminal-record data, including controlling entry to processing premises, controlling who can read, copy or alter data carriers, controlling use of and access to the processing systems, and logically separating health and sex life data, including genetic data, from other personal data.

Allow access only to users on the basis of user roles, authentication and authorization, keep audit records of all activity in the system, and require strong passwords of at least 16 characters (Article 8).

Designate by function the staff who may access special-category personal data, keep that list available to the Data Protection Authority, and bind those staff to confidentiality by a legal, statutory or contractual duty.

If several people work in the facility, create a rights and roles concept so that only authorized persons can further process the data and each further processing is logged (Section 6, paragraph 1).

Where you rely on an Article 8(2) exception, protect special categories of personal data with heightened, classified safeguards against unauthorised access and use.

Apply the measures Article 181-3 lists: a data protection officer, impact assessments, anonymization, pseudonymization or functional separation, encryption in transit with state-of-the-art key management, access restrictions, logging of the reason, date, time and person for each access, staff awareness, regular independent audit, sectoral codes of conduct and an internal policy on the principles of GDPR Article 5 (Article 181-3, paragraph 1, point 2).

Never derogate from the encryption, access restriction, logging, staff awareness and internal policy measures (Article 181-3, paragraph 3).

Handle special-category health data only by or under a person bound by professional secrecy where the processing is for preventive or occupational medicine, diagnosis, or healthcare.

Distinctively designate and protect special categories of data against unauthorised access, under Article 13.

If you hold the list of sensitive zones, pass it only to people who need to know it and have access to it for their functions or mission in deploying and operating the 5G network (Article 105, paragraph 7).

Update access rights where changes are necessary and at least once a year for all ICT systems other than those supporting critical or important functions, and at least every 6 months for ICT systems supporting critical or important functions (Article 21).

Since 18 June 2026, do not give privileged access to your ICT systems to a staff member convicted of an intentional crime linked to terrorism, against the state, the administrative order or property, or in the economy, unless they are rehabilitated or the conviction has been cleared; if such a person is convicted and not cleared, decide individually on their employment after weighing the security risk (Article 26.1).

The Department says you should consider authentication factors that can withstand AI-manipulated deepfakes, avoiding authentication by SMS text, voice or video and using forms such as digital-based certificates and physical security keys; it states that as of November 2025 the regulation requires multi-factor authentication for all authorized users attempting to access your information systems or nonpublic information, and that your access controls must limit each authorized user's privileges to those necessary for the user's job functions.

The Department says you should consider restricting multi-factor authentication enrollment and changes to authorized processes with strong identity verification, employing phishing-resistant multi-factor authentication methods such as authenticator applications with number matching or hardware tokens, and conducting privileged access reviews, especially for threat-relevant users, systems and devices.

Based on your risk assessment, limit user access privileges on information systems that provide access to nonpublic information to only those necessary to perform the user's job, limit the number of privileged accounts and their access functions to only those necessary to perform the user's job, and use a privileged account only when performing functions that require that access.

Review all user access privileges periodically and at least annually, and remove or disable accounts and access that are no longer necessary; promptly terminate access following departures.

Implement technical and organizational measures appropriate to the risk under Article 34, including pseudonymization and encryption where appropriate, and instruct anyone with access to personal data not to process it beyond the controller's authorization.

Do not process personal data you access in the course of your duties except on the controller's instructions, unless the law requires otherwise, and keep personal data confidential as a matter of professional secrecy, both during and after your role ends.

Implement technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or alteration, confine internal access to what each role requires, and train staff on their data protection duties.

Store or process personal data with technical and organizational security measures that protect against unauthorized or unlawful processing and against unintentional loss, destruction, or damage, and limit access to staff who need it for their duties.

Take precautions appropriate to the nature of the data, including restricting access to authorized staff and keeping security copies.

Apply Provvedimento 146/2019's security measures (documented access controls, encryption or pseudonymization, controlled transmission) before processing genetic data of a person in Italy.

Rely on a Polish employee's consent to process their biometric data only where the employee supplied the data on their own initiative, and let only people you have authorized in writing process it, bound to confidentiality, under Kodeks pracy Article 22(1b); processing needed to control access to particularly important information or to premises that need special protection is also permitted under Article 22(1b).

An app that collects or processes biometric data, meaning physical attributes and unique, stable biological characteristics used to identify a person, from an individual in Vietnam must apply physical security measures, limit access, and maintain a monitoring system to detect infringement, and must notify the data subject where its processing damages that person.

Do not collect, process, publish or share the personal data of a child under 13 unless you obtain explicit, documented, verifiable parental consent, provide a rapid way to withdraw it, disclose your data-privacy policy and restrict access to authorised personnel.

Apply the required security safeguards to a restricted vendor, employment, or investment transaction that would give a country of concern or covered person access to that data.

Establish internal procedures to prevent abuse of, unauthorized access to and unauthorized transfers of personal and other data, and ensure human oversight of and, where necessary, human intervention in the processing (Article 3(1), point (g)(i) and (ii)). Do not report material not previously identified as online child sexual abuse material, or solicitation of children, to law enforcement authorities or to organizations acting in the public interest against child sexual abuse without prior human confirmation (Article 3(1), point (g)(iii)).

It reaches you if you are the vendor of an application using smart contracts or, in the absence of one, the person whose trade, business or profession involves deploying smart contracts for others, in the context of executing an agreement, or part of one, to make data available (Article 36(1); Article 1(3), point (g)). Make those smart contracts robust and access-controlled: design them to offer access control mechanisms and a very high degree of robustness to avoid functional errors and to withstand manipulation by third parties (Article 36(1), point (a)).

Protect the smart contract through rigorous access control mechanisms at the governance and smart contract layers, and keep it consistent with the terms of the data sharing agreement that it executes (Article 36(1), points (d) and (e)).