Where are the data processed?
Distinguish between the local model, cloud connectors, backups, logs, and maintenance services. A single external integration can create a transfer that needs to be documented.
What questions to ask before deployment?
- Which data are truly necessary?
- Who can view, correct, and delete them?
- How long are they retained?
- Which subcontractors and countries are involved?
- How to restore or return data at the end of the contract?
Local does not mean risk-free
An unprotected workstation, a powerful account, or an unencrypted backup can expose data even without cloud. Security must cover rights, network, encryption, updates, and traceability.
Important: this guide provides general technical guidelines and does not replace legal advice tailored to the processing concerned.
A reasonable approach
- Reduce data to the strict minimum.
- Separate environments and roles.
- Test without sensitive data.
- Document access and durations.
- Plan for export, deletion, and restoration.