Technical & Organisational Measures (TOMs)

DPV's taxonomy of tech/org measures are structured into four groups representing TechnicalMeasure such as encryption or deidentification which operate at a technical level, OrganisationalMeasure such as policies and training which operate at an organisational level, LegalMeasure which are organisational measures with legal enforcement such as contracts and NDAs, and PhysicalMeasure which are associated with physical aspects such as environmental protection and physical security. Each of these is provided with a taxonomy that expands upon the core idea to provide a rich list of measures that are intended to protect personal data and technologies (and its associated entities and consequences).

To indicate applicability of measures, the relations hasTechnicalMeasure, hasOrganisationalMeasure, hasLegalMeasure, and hasPhysicalMeasure are provided. In addition to these, specific relations are also provided for concepts commonly used or which are important for legal considerations - such as hasNotice and hasPolicy.

Technical measures refer to measures that are implemented at a technical level. They are represented by the concept TechnicalMeasure and are indicated using the relation hasTechnicalMeasure. Concepts provided to represent commonly used technical measures include AccessControlMethod, AuthenticationProtocols, AuthorisationProtocols, CryptographicMethods, DataBackupProtocols, DigitalRightsManagement, Encryption, and SecurityMethod.

To express information about the technology implementing the technical measure, the concept Technology can be associated by using the relation isImplementedUsingTechnology. The [TECH] extension provides further concepts to represent technologies and their development and provision.

Organisational Measures, represented by the concept OrganisationalMeasure, are measures that are undertaken at an organisational level i.e. by the human involved within the organisation. They involve aspects such as performing assessments, consultations, establishing governance procedures, providing notices, contracts, policies, record keeping, and other similar activities. Though such activities can utilise technologies to support their implementations, the measure is still primary categorised as being associated with 'organisational activities'. Organisational measure are indicated by using the relation hasOrganisationalMeasure.

LegalMeasure represents organisational measures which have a legal enforcement mechanism or are legally defined/interpreted. For example, through contracts, NDAs, agreements. They are associated by using hasLegalMeasure.

PhysicalMeasure represents measures that have a physical implementation - such as physical access control or environment controls for floods, power outages, etc. They are associated by using hasPhysicalMeasure.

All technical and organisational measures are intended, by definition, to provide better security and handling of personal data and its associated processing and other activities. In DPV's taxonomy, some measures directly and specifically relate to security as their topic, whilst others provide their intended benefit indirectly. For example, the concept SecurityAssessments is an organisational measure relating to how security is assessed (and thus ultimately improved) - and is directly associated with security as a topic. Whereas a concept such as ProfessionalTraining relates to measures that are not directly tied to security, but can be associated in cases where the training is related to security or specific security measures or risks (e.g. cybersecurity data breach mitigations). The purpose EnforceSecurity provides a common umbrella term for personal data that is utilised for enacting and enforcing security measures, such as for authorisation and authentication.

Technical measures that relate specifically to security include SecurityMethod for providing security, and its subtypes for DocumentSecurity, FileSystemSecurity, HardwareSecurityProtocols, IntrusionDetectionSystem, MobilePlatformSecurity, NetworkSecurityProtocols, OperatingSystemSecurity, WebBrowserSecurity, WebSecurityProtocols, and more. Organisational measures that relate specifically to security include SecurityProcedure, and its subtypes for BackgroundChecks, CybersecurityAssessments, CybersecurityTraining, SecurityAssessments, and more.

The term Data Processing Agreement refers to a broad concept related to contracts or agreements between entities representing conditions regarding the processing of (personal-)data. This can include ad-hoc 'data handling' policies such as NDAs, embargoes, and enforcement of practices, as well as more formal and legal binding contractual obligations such as those between a Controller and a Processor.

To represent such concepts, DPV provides LegalAgreement, along with subtypes for NDA (Non-disclosure agreements), ContractualTerms, and DataProcessingAgreement. In these, it is important to remember that while contract can also be as a form of legal basis, the concept represented here is not necessarily the same contract as that is used to justify the processing of personal data with a data subject. Instead, contracts are a broad category representing contractual terms governing data handling within or with an entity.

For representing specific agreements between entities (other than those with data subjects - which are covered in Legal Basis taxonomy), DPV provides the following types of agreements:

• ControllerProcessorAgreement: An agreement between a Controller and a Processor, where the Controller instructs the Processor(s) to carry out processing on its behalf.
• JointControllersAgreement: An agreement between two or more Controllers to act as a 'Joint Controller'.
• SubProcessorAgreement: An agreement between two or more Processors where one Processor instructs another to carry out processing on its behalf.
• ThirdPartyAgreement: An agreement between a Data Controller or a Data Processor, and a Third Party. Note that this is a loosely defined concept, as depending on the jurisdiction, this relationship may result in the Third Party being a Data Controller or a Joint Data Controller.

To indicate the entities involved in an agreement, the relation hasEntity can be used, or relations associated with specific roles to indicate contextuality. For example, using hasDataController with a ControllerProcessorAgreement denotes the Data Controller for that agreement.

While all technical and organisational measures are intended to safeguard personal data and its associated activities, there may be contextual or use-case requirements to explicitly indicate safeguards against or for specific criteria. To enable such use, DPV provides the concept Safeguard and its subtype SafeguardForDataTransfer for indicating application when data is being transferred. Through these, it is possible to represent aspects such as policies for data transfers, specific measures such as encryption being applied, and other pertinent information in combination with DPV's concepts from technical and organisational measures.