GDPR and field work.

What is GDPR?

How it touches on-site IT work

• Screens, labels and tickets: an engineer who can see a screen, a mailbox, a ticket or an asset label with a user name can see personal data. Most field tasks do not need that data, so the aim is to limit what is seen to what the task requires.
• Removed drives and media: a drive that leaves the site carries whatever it holds. The European Data Protection Board gives losing a USB key with customer data as an example of an accidental breach, so removed media needs a named custodian, a movement log and a defined route to wiping, return or destruction.
• Photos taken on site: evidence photos can capture people, screens, badges and documents. What may be photographed, where photos are stored and when they are deleted should be agreed before the visit.
• Subcontractors and third parties: a provider that uses independent engineers or partner firms is using sub-processors when they handle personal data. GDPR requires the controller's written authorization before another processor is engaged, and the same data protection terms must be passed down by contract.
• Incident reporting: the controller's 72-hour clock starts when it becomes aware of a breach, so the provider's prompt notice matters. A lost laptop, a mislabeled drive or a photo sent to the wrong person should reach the customer straight away, with details added as they become known.
• Logging who did what: records of who entered a site, which assets they touched and when support the customer's own accountability and make breach investigation faster.

What you can agree in a written scope

• A data processing agreement, or equivalent clauses, signed before work starts, covering the points GDPR requires in a processor contract.
• Work only on the customer's written instructions, with the task, systems and areas in scope named.
• Confidentiality commitments for every person who may see data, including independent engineers.
• A list of approved subcontractors, or a rule that a new one needs written approval, with the same data protection terms passed down.
• Photo rules: what may be photographed, what must be avoided or cropped, how photos are sent, where they are stored and when they are deleted.
• Media handling: a custody log, sealed transport, an agreed wipe or destruction method with evidence, and return or deletion when the work ends.
• Incident reporting: who is told, by what channel, within how many hours, and with what details.
• Access and work records: sign-in and sign-out, escort rules and the ability to ask who worked on which asset on a given date.
• Retention and deletion of ticket data, attachments and logs at the end of the engagement.
• Where data may be processed and stored, including any transfer outside the European Economic Area.

Questions to ask any field services provider

• Do you act as a processor for our data, and will you sign a data processing agreement before the first visit?
• Who will actually attend our site (employees, independent engineers, partner firms), and how is each bound to confidentiality?
• Which of them are sub-processors, and how do you get our approval for a new one?
• What happens if a laptop, drive or photo is lost or sent to the wrong person, and how soon will we hear?
• Where are photos, tickets and logs stored, who can see them and how long are they kept?
• How do you track a removed drive from our site to its final wipe or destruction?
• Can you show who worked on our site or assets on a given date?
• What happens to our data when the engagement ends?

This page is general information and not legal advice. Deploris does not claim certification or compliance status here. Confirm what applies to you with your own counsel or compliance team.