Data Security Concept

Definition of a data security concept and legal foundations

A data security concept is a sub-area of data protection that describes a data protection approach to ensure the necessary framework for the collection, processing, and use of personal data. The data collected, processed, and stored is documented to lawfully comply with the requirements of the GDPR (general accountability and documentation obligations (Art. 5 (2), 24 GDPR)). A data security concept specifically covers the areas of accountability and documentation obligations, IT security, and technical and organizational measures.

The data security concept is based on the following principles for the processing of personal data under Art. 32 (1) GDPR:

• Confidentiality of collected data against unauthorized access / disclosure.
• Integrity: Technical and factual accuracy as well as the completeness of all collected data during processing.
• Availability: During a data processing operation, all data, IT systems, and networks are available to ensure comprehensive and secure access.
• Resilience of systems, networks, applications, etc., to ensure data security in the event of an incident or similar.

Goal of a data security concept

The goal of a data security concept is to protect collected personal data throughout its processing and storage period in accordance with the four principles mentioned above. Since the processing of (personal) data is now inextricably linked to IT, IT is a core component of a data security concept and is decisive for data security.

Components of a data security concept

As mentioned in the previous point, since the security of personal data is linked to information technology (IT), it is the main component of a data security concept. In terms of data security, IT is in turn linked to technical and organizational measures (TOM). For companies, TOM primarily means technical default settings to ensure adequate data protection. TOM includes a wide range of measures, from controlled access to office buildings to the pseudonymization and encryption of personal data.

To ensure that all data security measures taken can be verified (for example, during an inspection by supervisory authorities or by a client in the context of data processing), they must also be documented in writing. Such written documentation of the measures you have taken also has a positive effect should you come into contact with supervisory authorities. You can find the appropriate template in the following section.

First, however, it is advisable to use a data protection compliance checklist to determine which personal data your company processes, where, how, and for how long, as well as where, how, and for how long this data is stored.

To ensure the continuous compliance of a data security concept, it is also useful to establish data protection management within the company.

Both in establishing a data security concept and data protection management, your Data Protection Officerwill assist you.

Data security concept: Template for download

To implement data security in your company in accordance with the GDPR and to establish a comprehensive data security concept with the necessary security measures, you can find the necessary content and/or templates for download here:

• Technical and organizational measures (TOM)
• Accountability and documentation requirements:
• Data Processing Agreement (DPA)
• Registration of the Data Protection Officer
• Obligation to maintain records of processing activities (ROPA) (Art. 30 GDPR)
• Data Protection Impact Assessment

You should also have a template for documenting data breaches (Art. 33 (5) GDPR) ready for emergencies.

We answer your questions about data security concepts:

Who needs a data security concept?

Every company that collects, processes, and stores personal data needs a data security concept to comply with GDPR regulations.

Is a data security concept the same for every company?

A data security concept varies from company to company. It primarily depends on the type of personal data a company collects, stores, and processes.

What does data security have to do with a data security concept?

Data security encompasses the protection of all data, including, for example, the protection of data on the internet. Data protection, in turn, is a subset of this and specifically covers the protection of personal data. To ensure the protection of personal data in particular, a data security concept is required.