§ 15 DSG NRW
Safeguards for the protection of personal data and other fundamental rights
(1)Where special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679 are processed, the controller shall provide for appropriate and specific measures to safeguard the fundamental rights and interests of the data subjects. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons associated with the processing, these shall include:
(2)1. technical and organisational measures to ensure that processing complies with Regulation (EU) 2016/679,
(3)2. measures to ensure that it can subsequently be verified and determined whether and by whom personal data have been entered, modified or removed,
(4)3. raising awareness among those involved in processing operations,
(5)4. restricting access to personal data within the controller and by processors,
(6)5. the anonymisation and, where this is not possible, the pseudonymisation of personal data,
(7)6. the encryption of personal data,
(8)7. ensuring the ability to guarantee the confidentiality, integrity, availability and resilience of systems and services in connection with the processing of personal data, including the ability to promptly restore the availability of and access to personal data in the event of a physical or technical incident,
(9)8. establishing a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing, or
(10)9. specific procedural rules which, in the case of a transmission or processing for other purposes, ensure compliance with the requirements of this Act and of Regulation (EU) 2016/679.
(11)Section 1
(12)Special processing situations within the scope of application of Regulation (EU) 2016/679