EU General Data Protection Regulation
Access-control and CCTV data can be personal data under the GDPR. Organizations must assess the lawful basis, transparency, retention, and security requirements for their processing. Articles 13 and 14 address information provided to individuals, and Article 15 addresses their right of access to personal data. Article 32 covers security of processing, while Chapter V governs transfers to third countries or international organizations.
According to Ovum report, more than 70% of the US companies operating in the European market are facing a budget increase pressure to achieve GDPR compliance in the EU countries.
This report further finds that more than 85% of the US based companies are finding themselves in a disadvantageous situation due to GDPR regulation including GDPR access control compliance requirements.
The main points related to GDPR access control compliance include:
- A robust access restriction mechanism should be in place
- Robust privacy policy based on GDPR data retention and sharing rules should be implemented
- Companies should integrate access control and identity management information for GDPR compliance of data privacy
- The video redaction technique should be in public facing CCTV monitoring system to achieve GDPR access control compliance
- High-risk activities into low risk activities should be minimized through anonymity and pseudonymized approach in all access control processes
Does Your Company Require GDPR Compliance?
All companies that deal with the data collection, data processing, data sharing and data storing of the natural people living in the European countries are required to adopt GDPR compliance. In addition, any company based in other countries, but operate in Europe will be subject to this regulation.
How to Make a GDPR Physical Security Compliance Company? #
The GDPR has applied since 25 May 2018. Regulators have published guidance to help organizations implement it, including the European Data Protection Board’s guidelines on processing personal data through video devices. Assess your access-control and CCTV workflows against the applicable requirements and current regulator guidance. These steps can help you get started:
- Get help from lawyers to understand the regulation properly
- Categorized high-risk and low risk-data that your company uses
- Find a roadmap to minimize the high risk data
- Manage the critical data first and low-risk data later
- Make a full assessment of the documents and security policies
- Repeat the process and make revisions, if required
Ready to modernize the way you manage access?
See how a modern access control system can improve security and simplify operations.
What to Check in a GDPR Compliant Company? #
For a GDPR physical security compliance company, check for the following checklist items:
- Is the data controller appointed for data processing?
- Data protection officer available as per Article 37
- Data retention duration policy in place
- Is privacy impact assessment PIA done
- Personal data handler employees are trained
- Policies and procedures are in place
- The company allows access right to owners for their personal data
- All security measures like encryption, Pseudonymisation, and others are in place
- And others related to issues, breach notification, data processing and international transfer of data should be in place.