Service · Cyber security

GDPR and personal data security

GDPR asks for »appropriate technical and organisational measures« and then leaves you to work out what that means. We turn the requirement into concrete configuration in Microsoft 365, file servers and business systems: who may open which records, what gets recorded, and what is encrypted once it travels outside the company.

Send an enquiry See the scope

Access

by role, not by habit

Audit trail

who opened what

72 hours

to report a breach

Encryption

for data on the move

What the service covers

How far we go depends on the information you hold. A payroll system full of CPR numbers needs more care than a newsletter list, and we never build more than the risk justifies.

Talk it through with us

Data map

We track down where personal data really sits: ERP, payroll, SharePoint, shared drives, spreadsheets in mailboxes and exports saved on laptops. That list drives everything else.

Named accounts

Shared logins such as »reception@« with a password everyone knows are replaced by personal Entra ID accounts, so each action can be traced to a person.

Audit trail

The Microsoft 365 audit log and file server auditing are enabled and retained long enough to investigate an incident months later.

Encryption

BitLocker on laptops, encrypted email for confidential and sensitive details, and TLS on every connection leaving your network.

Leavers

A fixed routine agreed with HR, so access is withdrawn on the last working day, including SaaS tools outside the domain.

Breach playbook

A short plan for the first 72 hours: who assesses the incident, who notifies Datatilsynet and which logs must be preserved.

How we deliver it

We start with whatever closes the biggest gaps fastest and leave the heavier work until the foundations are sound.

Overview

A call with your data controller and a remote review of your environment produce a list of systems holding personal data and how well each is guarded today.

Quick wins

Shared logins, stale accounts and missing MFA are cleaned up within days. The difference is visible straight away.

Technical measures

Encryption, logging, a sensible permission structure and limits on external sharing are rolled out in planned stages.

Evidence

You receive a summary of the measures that slots into your GDPR records and can be shown to an auditor or to Datatilsynet.

Many of the breaches reported to Datatilsynet involve no hacker at all. They are emails sent to the wrong recipient, laptops left behind and former staff whose accounts still work. That is why the most valuable fixes lie in everyday routines rather than in expensive products.

Common questions

No. That agreement covers Microsoft's responsibility for the platform. How you configure access, sharing and logging is your responsibility as data controller, and that is exactly where most weaknesses appear.

No. Encryption pays off where data can slip out of your control: laptops, USB sticks, backups and emails carrying confidential details. A server in a data centre with controlled access has different needs.

Contact us at once. We help contain the leak, preserve the logs and gauge the scope, so you can decide on notifying Datatilsynet within 72 hours. The legal judgement stays with you or your adviser.

We supply the technical side and describe the measures in a form your record of processing activities can use. Legal wording belongs with your lawyer, but we make sure it matches what the systems really do.

Related services

View the whole area

Service Security policies and documentation Policies and procedures people can actually follow Service Security solution deployment Selecting, piloting and rolling out security tools Service Infrastructure protection Perimeter, network zones and secure remote access Service Application security Roles in business systems and integration accounts

Get your personal data under control

Tell us which systems hold information about customers and staff. We will come back with a view on where the weak spots usually are.

Email
office@apply.dk

Coverage
All of Denmark, delivered remotely

I agree that Apply may handle my details as set out in the privacy policy