S 2.506 Obligation/briefing of staff members for the processing of personal data

Initiation responsibility: Top Management

Implementation responsibility: Data Protection Officer, Personnel Department, Supervisor

The persons employed in the field of data processing must be committed to and/or informed about data secrecy when commencing their employment. The obligation to maintain data secrecy is also applicable after the employment is terminated. The obligation/briefing must be performed in a suitable manner, the implementation must be documented, and obligation/briefing should be repeated if required.

Individual state data protection laws substituted the obligation by briefing.

Note:

Even if an obligation and/or briefing of the employees regarding the maintenance of data secrecy already exists for different reasons, it should be reviewed in order to make the employees aware of the data protection requirements. There are corresponding sample declarations of obligation provided by the Federal Commissioner for Data Protection at www.bfdi.de supporting the Data Protection Officer both in government agencies and in companies. For briefing, there are suitable leaflets provided by the State Commissioners for Data Protection.

Review questions:

© Federal Office for Information Security. All rights reserved.