Personal Data

Secure Vectors is one of the few manufacturers to provide international privacy protection badges. At present, there are medical cloud providers using the EuroPriSe privacy protection standard as the framework of personal data protection. Adopt stricter international standards to meet international privacy practices. The privacy protection standard services provided by our company include:

• EuroPriSe: European Privacy Seal
• Datenschutz-Gütesiegel

The consultant services of the privacy protection standard shall assist the standards of organization in establishing the technical protection, management system to comply with international standards or laws by the procedures required.

International Security Standard: Privacy Protection Standards Consulting Service

Secure Vectors provide various types of consulting services. In addition to NIST 800-122, which is applied to the safety standard reference in the consulting work, ISO 22307 is applied to the privacy impact assessment. The following is the privacy standard of the company's main guidance:

Personal Data Privacy and protection is a fundamental human right all over the world. Organizations make protection of personal data, not just follow and meet the requirements of the Act, the general principle is respect for fundamental rights and freedoms of the parties, in particular, to protect the rights of personal data, regardless of their gender, age, identity status, nationality or residences vary.

In recent years, countries around the world or regional organizations constantly revised and sophisticated personal data protection and privacy regulations, especially in the EU General Data Protection Regulation (GDPR) strictly regulate the behavior and requirements of business organizations.

Controllers should adopt rules and measures that are consistent with the design (by design) and default (by default) data protection principles. These measures include but are not limited to the minimization of personal data processing, pseudonymising personal data as possible, the transparency of personal data processing and roles, the data subject's ability to monitor data processing, and controllers being able to create and enhance security capabilities. Appropriate technical and organizational measures should include, but are not limited to, the following:

• Ensure the continuous confidentiality, integrity, availability and flexibility of systems and services.
• Respond to the availability and accessibility of personal data in a timely manner after the accident.
• Regularly test, evaluate, measure and ensure the effectiveness of safety measures.

In the course of operation and management of a business organization, regardless of the amount of personal data handled, there will be collection, processing, utilization, and transmission. Therefore, the import and build appropriate management system to protect the rights and interests, and comply with laws and regulations, has become a core competency of the management of modern business organizations.

The SVITI Professional Services team includes senior consultants, lawyers and technical experts who are familiar with the Personal Data Protection Act and international standards, and assist companies in the following work projects:

The team will assist the business organization in analyzing the operational procedures involving personal data in each unit, and compare the existing system with the connotation of international standards, modify the existing regulations, and achieve the goal of personal data management. Senior consultants, lawyers, and technical experts analyze the differences in status, examine the existing processes of management organizations, technical aspects, and legal inspection organizations, and produce a difference analysis report.

Profile inventory — generate personal data inventory lists by the project team, and conduct personnel training.

Technical experts and lawyers will review the resource inventory results of each unit, and provide guidance on how to merge and simplify inventory results, as well as correct non-standard naming or unclear, erroneous count results.

Integrated risk assessment and job-owned inventory — consider the identity of the organization and design appropriate inventory and risk assessment fields so that all units can legally perform and simultaneously complete the risk assessment work required by international standards. Risk assessment methodology — help organizations design an easy-to-understand risk evaluation methodology, and promote education and training so units can maintain and operate their own risk evaluation in the future.

Use the most complete international standard as the main framework of the management system, ensuring all management systems of the enterprise organization are managed and controlled under complete policies and principles. All standards and system construction take the Act's requirements as the ultimate goal. Workflow documents will refer to JIS Q 15001 (Personal Information Management System), NIST 800-122 for PII management and control, and ISO 29100 for personal information lifecycle management, bringing information management closer to international standards.

The team of advisors will assist companies in organizing a law-related inventory of laws and regulations. With the assistance of professional legal experts, the risks of omissions from the inventory of consultants or dedicated personnel of each unit can be avoided.

The protection of personal data is a legal issue. How to comply with the requirements of the law is the focus that all organizations and companies must pay attention to. Our methodology of compliance checking is based on the matured methodological framework for compliance validation in Germany and the European Union. It is based on Taiwan's Personal Data Protection Act, its enforcement rules and other relevant ordinances as the basis for the inspection framework.

SVITI combined with practical experience in Taiwan, lawyers specializing in data protection law, and personal data protection verification joint operations. This verification service introduces the methodology of the German Personal Data Protection Verification System. It examines personal data from the management, technical and legal aspects to ensure that the organization meets the requirements of the Personal Data Protection Act.

In accordance with German inspection methods for products and services, the verification service will check the following items for the protection of personal data:

Our compliance checking follows the EU and German compliance checking methodology and requirements, carried out by Certified Technical Experts (professionals with information security, personal data protection and auditing) and Certified Legal Experts (with lawyer qualification and compliance checking training):