A shared-services centre hosts multiple municipalities on one platform with no logical separation of each city’s resident data or access paths. Which security-design concern is most directly raised under GDPR TOMs?
Select an answer to reveal the explanation.
Short Explanation
Parking every city’s resident files in one open barn is a bad floor plan. Appropriate technical measures include isolation and access control so one tenant’s staff cannot wander into another’s data. Public-body status does not erase that design need.
Full Explanation
Lack of multi-tenant isolation and access control undermines appropriate technical measures to prevent unauthorised access across customers under Article 32. A shared-services centre hosting multiple municipalities on one platform with no logical separation of each city’s resident data or access paths creates cross-tenant confidentiality risk. Shared platforms do require isolation even if all tenants are public bodies. Logical separation is not irrelevant because backup encryption alone always suffices. Multi-tenant hosting does not automatically anonymise resident records at rest. Exam caveat: multi-tenant TOMs centre on isolation and access control between processing contexts. Operational check: require tenant isolation, separate encryption keys or access paths where feasible, and penetration tests proving one municipality’s admins cannot read another city’s resident data before go-live. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.