what has happened
The BOE publishes Organic Law 7/2021, relating to the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and execution of criminal sanctions.
Why it matters
Although many companies will not be at the center of this standard, it may affect projects with administrations, security, investigation, digital evidence, incident management or collaboration with authorities.
What to check now
When processing logs, evidence, recordings, incident data or sensitive personal information, it is advisable to separate purposes, keep only what is necessary, control access and document legal basis and deadlines.
Relationship with cybersecurity
A security incident can generate evidence with personal data. Technical management must be coordinated with privacy: who accesses it, for what, for how long and how the information is protected.
Checklist for companies
- Classification of evidence that contains personal data.
- Control of access to logs and internal investigations.
- Retention and deletion policy.
- Traceability of queries and exports.
- Coordination between security, legal and data protection.
Do you want to check if this affects your company?
We can help you translate the news or standard into concrete actions: scope, gaps, evidence and priorities.
Request diagnosis