A shared-services centre hosts multiple municipalities on one platform with no logical separation of each city’s resident data or access paths. Which security-design concern is most directly raised under GDPR TOMs?
Select an answer to reveal the explanation.
Short Explanation
Parking every city’s resident files in one open barn is a bad floor plan. Appropriate technical measures include isolation and access control so one tenant’s staff cannot wander into another’s data. Public-body status does not erase that design need.
Full Explanation
Appropriate technical measures under Article 32 include controls that prevent unauthorised access and ensure confidentiality among distinct processing contexts. In multi-tenant architectures, logical separation and access control are core design expectations so one municipality’s users cannot reach another’s personal data. Neither public-sector status nor backup encryption alone cures missing tenant isolation.