IDHIS – Information Governance Certification Programme

The transparency criteria shall ensure that the data subject is correctly informed and fully aware of the processing of any personal data. The data subjects must be aware of the processing of any personal data. The data subjects must be aware of risks, rules, safeguards, and their rights in relation to the processing and how to exercise these rights. The organisation’s registries of clients and partners participating in the data processing have to be updated and consultable.

• As a data subject, do I have all relevant information and are all legal bases defined as legitimate interests? How is this checked within your company?
• Are you sure that your clients’ register is up to date? What are the corrective measures if the register is not up-to-date?

This section refers to their onboarding and offboarding of users procedures, including access management and their management of cyber security. This also includes the organisation’s ability to monitor and manage risk, their procedures for review and improvement and penetration tests, as well as internal audits.

• How do you check if the information security action plan is managed correctly?
• Do you check if the employee’s responsibilities related to data handling are defined and executed in line with the ISMI?

This set of Audit Readiness criteria focuses on the management and availability of logs of the auditing files and whether the organisation is able to respond to external audits. This section also focuses on the protection of the logs as well as their details.

• Can your audit logs prove that the data have been retained, archived or destroyed according to the contract/agreements, ethics or scientific committee and/or statutory legal requirements?
• Do your data assets registers contain audit logs and are checked for correct use?

This set of Data Processing criteria checks on determining minimum data requirements, upholding data inventory agreements, conducting Data Protection Impact Assessments (DPIA), handling minimisation of data through anonymisation and pseudonymisation and retaining data as per regulatory requirements are also within the focus of this set of criteria.

• Does your organisation check if the data minimisation and retention conform as defined in the agreements? What if this is not the case?
• ­How are you sure that your DPIA’s cover all GDPR and local supervisory authorities’ policies?

This set checks the ability to enforce its own compliance and contractual obligations on its staff and partners. It also checks the enforcement of data protection supervisory authorities. They also assess the performance of the Data Protection Officer and the proof of internal staff training regarding correct and adequate data handling matters.

• If supervisory authorities start an investigation on a GDPR issue, are you prepared to enforce the required information? Is this also defined in the agreement with your clients/stakeholders?
• Does your DPO reply to external queries within the required time limits?