Compliance

This is the Compliance demo. Every visitor shares this company, and it resets every night.

What you change here, everyone sees until the next reset. Email, payments, and the AI models are switched off.

Start your own trial
  • EU GDPR (2016)
  • ISO 27001:2022
  • NIS2
  • NIS2 Netherlands (Cbw, 2026)

Nothing found that matches the search criteria.
Start your own trial
SV
Sam de Vries
sam.devries@tidewell-it.example
Legal

Edit POL-008

Cancel
Body

Purpose

This Policy sets how Tidewell IT protects personal data and respects the rights of the people it concerns, as Regulation (EU) 2016/679 requires.

Scope

This Policy covers all personal data that Tidewell IT processes, whether about staff, applicants, customer contacts, or the users of our customers' systems, and everyone who handles it.

Policy statements

Roles

  1. Tidewell IT is controller for the data of its staff and of customer contacts, and processor for customer data that it holds on a customer's behalf.

Principles

  1. We follow the seven principles of Article 5: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

Lawful basis and transparency

  1. We process personal data only on a lawful basis that is recorded before processing starts, and we tell people in plain language what we do with their data.
  2. Consent is used only where no other basis fits, and it can be withdrawn as easily as it was given.

Records of processing

  1. The Data Protection Officer keeps the record of processing activities, as controller and as processor, and updates it when a process changes.

Data subject rights

  1. Requests are acknowledged within 3 working days and answered within one month.
  2. Requests that reach a colleague are forwarded the same day to privacy@tidewell-it.example.

Data protection by design

  1. New systems, services, and changes that process personal data are assessed for privacy before they go live. The default settings collect and expose as little data as possible.
  2. A data protection impact assessment is carried out when processing is likely to cause a high risk to people.

Processors and transfers

  1. A processor is engaged only under a data processing agreement. Personal data stays inside the EEA unless the Data Protection Officer confirms a lawful transfer mechanism.

Breaches

  1. The Data Protection Officer assesses a breach within 24 hours of detection.
  2. As controller, Tidewell IT notifies the Autoriteit Persoonsgegevens within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights.
  3. As processor, it tells the affected customer without undue delay and within 24 hours.

Special categories

  1. Special-category data is limited to HR and occupational health data and is accessible only to those who need it for that purpose.

Data Protection Officer

  1. The Data Protection Officer is independent, takes no instructions on the advice given, and reports to the Management Board.
  2. People can reach the Data Protection Officer at privacy@tidewell-it.example.

Roles and responsibilities

The Data Protection Officer owns this Policy and advises on its use. The Management Board is accountable for compliance. The Service Desk Lead and the HR Lead make sure that requests and staff data are handled as written. Everyone who handles personal data follows this Policy.

Exceptions

An exception needs a written request to the Data Protection Officer that states the reason, the risk, and an end date. No exception can lower a right that the Regulation gives to a person.

Compliance and enforcement

Breaches of this Policy lead to disciplinary measures under the HR process. The Data Protection Officer reports on compliance to the Management Board at every management review.

Related documents

  • Data Subject Request Handling Procedure
  • Personal Data Breach Notification Procedure
  • Information Classification and Retention Policy
  • Supplier Security Policy
  • Incident Response Policy

Review

The Data Protection Officer reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.
    • — none —
    • PER-001 — Sam de Vries
    • PER-002 — Annelies Verbeek
    • PER-003 — Kasper Hoogland
    • PER-004 — Marloes Brinkman
    • PER-005 — Nadia El Idrissi
    • PER-006 — Lotte van Dijk
    • PER-007 — Thijs Bosman
    • PER-008 — Anika Raghavan
    • PER-009 — Daan Rijnders
    • PER-010 — Eva Lundmark
    • PER-011 — Selim Aydogdu
    • PER-012 — Ioana Vasilescu
    • PER-013 — Finn de Rooij
    • PER-014 — Gerrit Smeenk
    • PER-015 — Wouter Hazelhoff
    • PER-016 — Aisha Rahman
    • PER-017 — Niels Dekker
    • PER-018 — Tariq Rashidi
    • PER-019 — Fleur Maas
    • PER-020 — Hans Overbeek
    • PER-021 — Marit Koster
    • PER-022 — Alessandro Ferrante
    • PER-023 — Yara Visser
    • PER-024 — Lars Ekstedt
    • PER-025 — Amira Khalil
    • PER-026 — Remco Bergsma
    • PER-027 — Roos van Beek
    • PER-028 — Dimitri Volkov
    • PER-029 — Esther Blom
    • PER-030 — Mustafa Karaca
    • PER-031 — Floris Adriaanse
    • PER-032 — Joris Kamphuis
    • PER-033 — Lieke Bakhuizen
    • PER-034 — Charlotte Veldhuis
    • PER-035 — Rik Meinders
    • PER-036 — Elena Marques
    • PER-037 — Judith Haanstra
    • PER-038 — Vera Dijkstra
    • PER-039 — Hanneke Rutten
    • PER-040 — Bram Oosterhuis
    • PER-041 — Stefan Kowalski
    • PER-042 — Imogen Clarke
    • PER-043 — Gustav Lindahl
    • PER-044 — Noah Smit
    • PER-045 — Sofie Claes
    • PER-046 — Marjolein Teunissen
    • PER-047 — Willem-Jan Roest
    • PER-048 — Rosalind Achterberg
    • PER-049 — Mikael Strand
    • PER-050 — Ilse Wiegman
    • PER-051 — Cornelis Vos
    • PER-052 — Patrick Ellison

    Nothing found that matches the search criteria.
    • ROL-001 — ISMS Manager
    • ROL-002 — Internal Auditor
    • ROL-003 — Data Protection Officer
    • ROL-004 — Service Desk Lead
    • ROL-005 — Change Manager
    • ROL-006 — Incident Coordinator
    • ROL-007 — Supplier Manager
    • ROL-008 — HR Lead
    • ROL-009 — Facilities Lead
    • ROL-010 — Management Board

    Nothing found that matches the search criteria.
    Who must approve this policy?
    Who must read this document?
    Requirements covered by this policy
    • Art. 5(1)(a) — Lawfulness, fairness and transparency (Mandatory)
    • Art. 5(1)(b) — Purpose limitation (Mandatory)
    • Art. 5(1)(c) — Data minimisation (Mandatory)
    • Art. 5(1)(d) — Accuracy (Mandatory)
    • Art. 5(1)(e) — Storage limitation (Mandatory)
    • Art. 5(1)(f) — Integrity and confidentiality (Mandatory)
    • Art. 6 — Lawfulness of processing (Mandatory)
    • Art. 13-14 — Information to be provided to data subjects (Mandatory)
    • Art. 12 — Transparent communication and exercising rights (Mandatory)
    • Art. 15 — Right of access (Mandatory)
    • Art. 16 — Right to rectification (Mandatory)
    • Art. 17 — Right to erasure ('right to be forgotten') (Mandatory)
    • Art. 18 — Right to restriction of processing (Mandatory)
    • Art. 19 — Notify recipients of rectification, erasure, or restriction (Mandatory)
    • Art. 20 — Right to data portability (Mandatory)
    • Art. 21 — Right to object (Mandatory)
    • Art. 24 — Responsibility of the controller (accountability) (Mandatory)
    • Art. 25 — Data protection by design and by default (Mandatory)
    • Art. 28 — Processor contracts (Mandatory)
    • Art. 30 — Records of processing activities (Mandatory)
    • Art. 32 — Security of processing (Mandatory)
    • Art. 33 — Notification of a personal data breach to the supervisory authority (Mandatory)
    • Art. 34 — Communication of a personal data breach to the data subject (Mandatory)
    • Art. 35 — Data protection impact assessment (DPIA)
    • Art. 37-39 — Data protection officer (DPO)
    • Ch. V — International transfers of personal data
    • 4.1 — Understanding the organisation and its context (Mandatory)
    • 4.2 — Understanding the needs and expectations of interested parties (Mandatory)
    • 4.3 — Determining the scope of the information security management system (Mandatory)
    • 4.4 — Information security management system (Mandatory)
    • 5.1 — Leadership and commitment (Mandatory)
    • 5.2 — Policy (Mandatory)
    • 5.3 — Organisational roles, responsibilities and authorities (Mandatory)
    • 6.1.1 — Actions to address risks and opportunities - general (Mandatory)
    • 6.1.2 — Information security risk assessment (Mandatory)
    • 6.1.3 — Information security risk treatment (Mandatory)
    • 6.2 — Information security objectives and planning to achieve them (Mandatory)
    • 6.3 — Planning of changes (Mandatory)
    • 7.1 — Resources (Mandatory)
    • 7.2 — Competence (Mandatory)
    • 7.3 — Awareness (Mandatory)
    • 7.4 — Communication (Mandatory)
    • 7.5.1 — Documented information - general (Mandatory)
    • 7.5.2 — Creating and updating documented information (Mandatory)
    • 7.5.3 — Control of documented information (Mandatory)
    • 8.1 — Operational planning and control (Mandatory)
    • 8.2 — Information security risk assessment (operational) (Mandatory)
    • 8.3 — Information security risk treatment (operational) (Mandatory)
    • 9.1 — Monitoring, measurement, analysis and evaluation (Mandatory)
    • 9.2.1 — Internal audit - general (Mandatory)
    • 9.2.2 — Internal audit programme (Mandatory)
    • 9.3.1 — Management review - general (Mandatory)
    • 9.3.2 — Management review inputs (Mandatory)
    • 9.3.3 — Management review results (Mandatory)
    • 10.1 — Continual improvement (Mandatory)
    • 10.2 — Nonconformity and corrective action (Mandatory)
    • A.5.1 — Policies for information security
    • A.5.2 — Information security roles and responsibilities
    • A.5.3 — Segregation of duties
    • A.5.4 — Management responsibilities
    • A.5.5 — Contact with authorities
    • A.5.7 — Threat intelligence
    • A.5.8 — Information security in project management
    • A.5.9 — Inventory of information and other associated assets
    • A.5.10 — Acceptable use of information and other associated assets
    • A.5.11 — Return of assets
    • A.5.12 — Classification of information
    • A.5.13 — Labelling of information
    • A.5.14 — Information transfer
    • A.5.15 — Access control
    • A.5.16 — Identity management
    • A.5.17 — Authentication information
    • A.5.18 — Access rights
    • A.5.19 — Information security in supplier relationships
    • A.5.20 — Addressing information security within supplier agreements
    • A.5.21 — Managing information security in the ICT supply chain
    • A.5.22 — Monitoring, review and change management of supplier services
    • A.5.23 — Information security for use of cloud services
    • A.5.24 — Information security incident management planning and preparation
    • A.5.25 — Assessment and decision on information security events
    • A.5.26 — Response to information security incidents
    • A.5.27 — Learning from information security incidents
    • A.5.28 — Collection of evidence
    • A.5.29 — Information security during disruption
    • A.5.30 — ICT readiness for business continuity
    • A.5.31 — Legal, statutory, regulatory and contractual requirements
    • A.5.33 — Protection of records
    • A.5.34 — Privacy and protection of PII
    • A.5.35 — Independent review of information security
    • A.5.36 — Compliance with policies, rules and standards for information security
    • A.5.37 — Documented operating procedures
    • A.6.1 — Screening
    • A.6.2 — Terms and conditions of employment
    • A.6.3 — Information security awareness, education and training
    • A.6.4 — Disciplinary process
    • A.6.5 — Responsibilities after termination or change of employment
    • A.6.6 — Confidentiality or non-disclosure agreements
    • A.6.7 — Remote working
    • A.6.8 — Information security event reporting
    • A.7.1 — Physical security perimeters
    • A.7.2 — Physical entry
    • A.7.3 — Securing offices, rooms and facilities
    • A.7.4 — Physical security monitoring
    • A.7.5 — Protecting against physical and environmental threats
    • A.7.6 — Working in secure areas
    • A.7.7 — Clear desk and clear screen
    • A.7.8 — Equipment siting and protection
    • A.7.9 — Security of assets off-premises
    • A.7.10 — Storage media
    • A.7.11 — Supporting utilities
    • A.7.12 — Cabling security
    • A.7.14 — Secure disposal or re-use of equipment
    • A.8.1 — User end point devices
    • A.8.2 — Privileged access rights
    • A.8.3 — Information access restriction
    • A.8.4 — Access to source code
    • A.8.5 — Secure authentication
    • A.8.6 — Capacity management
    • A.8.7 — Protection against malware
    • A.8.8 — Management of technical vulnerabilities
    • A.8.9 — Configuration management
    • A.8.10 — Information deletion
    • A.8.12 — Data leakage prevention
    • A.8.13 — Information backup
    • A.8.14 — Redundancy of information processing facilities
    • A.8.15 — Logging
    • A.8.16 — Monitoring activities
    • A.8.17 — Clock synchronization
    • A.8.19 — Installation of software on operational systems
    • A.8.20 — Networks security
    • A.8.21 — Security of network services
    • A.8.22 — Segregation of networks
    • A.8.23 — Web filtering
    • A.8.24 — Use of cryptography
    • A.8.25 — Secure development life cycle
    • A.8.26 — Application security requirements
    • A.8.27 — Secure system architecture and engineering principles
    • A.8.28 — Secure coding
    • A.8.29 — Security testing in development and acceptance
    • A.8.31 — Separation of development, test and production environments
    • A.8.32 — Change management
    • A.8.33 — Test information
    • CIR 2024/2690 Annex 1 — Security policy and responsibilities
    • CIR 2024/2690 Annex 2 — Risk management, compliance monitoring and independent review
    • CIR 2024/2690 Annex 3 — Incident handling, monitoring and logging
    • CIR 2024/2690 Annex 4 — Continuity plan, backups and crisis management
    • CIR 2024/2690 Annex 5 — Supply chain policy and supplier register
    • CIR 2024/2690 Annex 6 — Secure acquisition, development and maintenance
    • CIR 2024/2690 Annex 7 — Measuring the effectiveness of security measures
    • CIR 2024/2690 Annex 8 — Awareness and security training
    • CIR 2024/2690 Annex 9 — Cryptography policy and key management
    • CIR 2024/2690 Annex 10 — Personnel security
    • CIR 2024/2690 Annex 11 — Access rights, privileged accounts and authentication
    • CIR 2024/2690 Annex 12 — Asset classification, handling and inventory
    • CIR 2024/2690 Annex 13 — Utilities, environmental threats and physical access
    • Cyberbeveiligingswet art. 21 — Duty of care (Mandatory)
    • Cyberbeveiligingsbesluit art. 6 — Security policy and responsibilities
    • Cyberbeveiligingsbesluit art. 7 — Risk management policy
    • Cyberbeveiligingsbesluit art. 8 — Incident handling and logging
    • Cyberbeveiligingsbesluit art. 9 — Business continuity and crisis management
    • Cyberbeveiligingsbesluit art. 10 — Supply chain security
    • Cyberbeveiligingsbesluit art. 11 — Secure acquisition, development and maintenance
    • Cyberbeveiligingsbesluit art. 12 — Cyber hygiene and training
    • Cyberbeveiligingsbesluit art. 13 — Cryptography policy
    • Cyberbeveiligingsbesluit art. 15 — Access policy
    • Cyberbeveiligingsbesluit art. 16 — Asset management
    • Cyberbeveiligingswet art. 24 — Board approval and training (Mandatory)
    • Cyberbeveiligingswet art. 25 — Duty to report significant incidents (Mandatory)
    • Cyberbeveiligingswet art. 26 — Early warning within 24 hours (Mandatory)
    • Cyberbeveiligingswet art. 27 — Notification within 72 hours (Mandatory)
    • Cyberbeveiligingswet art. 28 — Interim report (Mandatory)
    • Cyberbeveiligingswet art. 29 — Progress report and final report (Mandatory)
    • Cyberbeveiligingswet art. 30 — Informing the recipients of your services (Mandatory)
    • Cyberbeveiligingswet art. 44 — Registration in the national register (Mandatory)

    Nothing found that matches the search criteria.
    Linked requirements show this document as a coverage source on each requirement's Details page.
    Implemented by procedures
    • PRO-001 — Access Request and Review Procedure
    • PRO-007 — Backup and Restore Procedure
    • PRO-005 — Change Management Procedure
    • PRO-009 — Data Subject Request Handling Procedure
    • PRO-003 — Incident Handling Procedure
    • PRO-010 — Internal Audit and Management Review Procedure
    • PRO-002 — Joiner, Mover and Leaver Procedure
    • PRO-004 — Personal Data Breach Notification Procedure
    • PRO-012 — Physical Access and Visitor Management Procedure
    • PRO-011 — Security Awareness and Training Procedure
    • PRO-008 — Supplier Onboarding and Review Procedure
    • PRO-006 — Vulnerability and Patch Management Procedure

    Nothing found that matches the search criteria.
    Comments on this Policy (0)

    Add comment

      Are you sure?

      This action cannot be reverted.

      Leave this page?

      Your changes on this form are not saved. If you leave, they are lost.