Recommendation on data processing in the home office.
If employees also process personal data of data subjects in their home office in the course of their professional activities, this data processing entails high risks for the personal rights of the data subjects, as data misuse or unauthorised interference by third parties is easier due to the limited control options of the employer. In the case of data processing in the home office, the employer remains responsible for compliance with data protection regulations and technical and organisational security.
The employed person should therefore be required to comply with appropriate measures in the home office in order to protect the personal data thus processed. The measures taken should be documented.
Technical security measures to protect personal data in the home office can be:- Employees should take measures for adequate access and burglary protection in the home office.
- Business equipment must be secured with a firewall, virus scanner and regular operating system updates.
- Data processing in the home office should only be carried out on company IT equipment.
- The data connection to the servers must be secured via VPN.
- Access to IT resources must be restricted with an authorisation concept and restrictive access authorisations.
- The connection of non-operational USB devices to the operational work equipment must be restricted.
- The computer equipment should not be accessible to other flatmates and should not be used by other persons.
- If paper files are processed in the home office, we recommend keeping a file withdrawal book in which it is documented which files are taken out of the company and brought back again.
- Paper files are to be kept in the home office in locked cupboards and inaccessible to other flatmates.
- If paper files are destroyed in the home office, an appropriate shredder must be provided for the destruction of the files (security level P4).
- The files should be transported safely on the way to the home office and must be protected against loss or theft.
- Regular data backups are to be made on local devices or data storage on local devices is to be prohibited/prevented.
- Home office agreements with employees should contain provisions according to which the employer can effectively check compliance with the agreed safety measures. The agreement should include a right of access for the employer and persons authorised by the employer (e.g. company doctor, data protection officer, supervisory authority). At the same time, it should be specified under which conditions the right of access may be exercised. The wording should be agreed with a specialist lawyer for labour law regarding compatibility with other provisions in the employment contract.
- Usage guidelines should regulate the handling of company IT and prohibit the use of noncompany equipment for the home office.
- Employees should be obliged to handle data and IT infrastructure securely in an IT security policy, see also: IT security policy.
- Work instructions can regulate the transport and destruction of files in the sense of electronic data processing without media disruption.