A municipal contractor takes printed citizen case files home overnight to finish work. Leadership calls it harmless because the files never left paper form. Which response best reflects GDPR security of personal data expectations?
Select an answer to reveal the explanation.
Short Explanation
Paper is still personal data—think of it like leaving a stack of medical charts on the subway seat. GDPR security is not a digital-only club. Physical custody rules, locked storage, and 'don't take case files home' controls matter just as much as encryption.
Full Explanation
Article 32 requires appropriate technical and organisational measures considering the risks of processing. Physical media carrying personal data remain in scope; controllers must address confidentiality and integrity for paper as well as systems. Unsupervised removal of citizen case files to a private home typically undermines those measures unless tightly controlled alternatives and safeguards exist.