NIST Privacy Framework, Protect-PPR.DS-P1

Implement technical and organizational security measures appropriate to the risk, including pseudonymization and encryption, the ability to restore access after an incident, and a process for regularly testing their effectiveness.

Implement technical and organisational measures giving a level of security appropriate to the risk, including pseudonymisation and encryption of personal data, the ability to restore availability and access in a timely manner after a physical or technical incident, and a process for regularly testing their effectiveness.

Implement appropriate technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction, or damage, including pseudonymization and encryption where appropriate, and test their effectiveness regularly.

Implement technical and organizational measures appropriate to the risk under Article 34, including pseudonymization and encryption where appropriate, and instruct anyone with access to personal data not to process it beyond the controller's authorization.

Retain the records in a medium that lets the competent authority access them readily and reconstitute each key stage of the processing of each crypto-asset service, activity, order or transaction, lets any corrections or other amendments and the earlier contents be ascertained, and does not allow the records to be manipulated or altered (Article 2(1)).

Store the records in a durable medium that allows them to be replayed or copied, retain them in a format that does not allow the original record to be altered or deleted, keep them readily accessible and available to clients on request, and ensure the quality, accuracy and completeness of the records of all telephone recordings and electronic communications (Article 76(10)).

Store the content data and related traffic data processed for these purposes, and the personal data generated through that processing, in a secure manner and solely for the purposes Article 3(1), point (h), lists once suspected online child sexual abuse has been identified, and no longer than strictly necessary for those purposes and in any event no longer than 12 months from the date of the identification of the suspected online child sexual abuse (Article 3(1), points (h) and (i)).

Keep the confidentiality of such communications and their traffic data when you store them technically to transmit the communication (article 4, paragraphs 1 and 3).

An app that captures or stores a facial image, voiceprint, or other biometric identifier of a person in Israel, including one derived from a photo, video, or audio recording, must treat it as data of special sensitivity and apply Israel's tiered security-level obligations, which scale up automatically at 100,000 or more biometric identifiers held.

Apply Provvedimento 146/2019's security measures (documented access controls, encryption or pseudonymization, controlled transmission) before processing genetic data of a person in Italy.

Store and transmit a captured biometric identifier with reasonable care equal to or exceeding the protection given your other confidential information, and destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.

If you operate or build a system that stores or processes health or other personal data in a Croatian national or institutional health information system, process the data with appropriate security and confidentiality and apply pseudonymization, encryption, restoration and regular testing measures (Rulebook Articles 6 and 7).

When processing sensitive personal data, build the capacity of staff involved, control who can access it, and apply technical and organisational measures appropriate to the risk, including storing it separately and applying tokenisation, pseudonymisation or encryption where appropriate.

Implement a written policy requiring encryption that meets industry standards, to protect the nonpublic information you hold or transmit both in transit over external networks and at rest.

If you determine that encrypting nonpublic information at rest is infeasible, secure it instead with effective alternative compensating controls that your Chief Information Security Officer has reviewed and approved in writing, and have that officer review the feasibility of encryption and the effectiveness of the compensating controls at least annually.