The security of personal data must be demonstrable.
The GDPR requires technical and organizational measures appropriate to the risk, taking into account the context, purposes and state of the art. NESQ supports the technical component: access protection, resilience, logging, effectiveness testing and incident management.
Areas of evaluation
- technical mapping of systems and flows that process personal data;
- identity, privileges, MFA and access segregation;
- encryption, key management and transfer protection;
- hardening, patching, endpoint and cloud security;
- logging, monitoring and traceability of activities;
- backup, availability, restore test and continuity;
- pseudonymization or minimization, where appropriate;
- suppliers, external managers and assistance accesses;
- data breach procedures and evidence preservation.
Verification of effectiveness
Policies and configurations are compared with evidence: recovery tests, access reviews, vulnerability assessments, simulations and exercises. The critical issues are sorted based on the risk for the organization and for the people involved.
Data breach support
In the event of an incident, NESQ helps reconstruct affected systems, accounts and datasets, distinguishing facts, clues and limitations. This information supports the owner, DPO and legal advisors in evaluating and documenting decisions.
Deliveries
The service produces technical reports, remediation plans, evidence of checks and indications for improvement. It does not replace legal advice or the role of the DPO.