gdpr european-union data-protection
GDPR Compliance - Password Protected Documents in AutoRecovery
<p>I'm working with personnel data in my job, including lots of details which I know to be sensitive and most certainly covered by GDPR.</p>
<p>In order to maintain compliance with the regulations while preserving the ability of our team to work on the same spreadsheets, we have hidden sheets and locked the Excel workbook every time it has been saved. This effectively obscures all personal data behind password protection.</p>
<p>A problem I have noticed however is that <strong>once the spreadsheet is unlocked and in use, MS Excel makes &quot;AutoRecovery&quot; copies</strong> of it which are accessible upon opening Excel.</p>
<p>I wanted to check where things stand under these circumstances - of Excel autosaves effectively leaving a copy of the document without password protection. I presume this is non-compliant, if this is the case, is the only way around this to turn off autosaving and recovery mechanisms from Excel (providing this is possible)?</p>
<p>Many thanks for any answers to what I hope is a fairly clear-cut question, but I can't be sure of my assumptions on the matter.</p>

<h2>What does your <a href="https://en.m.wikipedia.org/wiki/Data_protection_officer" rel="nofollow noreferrer">Data Protection Officer</a> say?</h2>
<p>It’s their role to be aware of and assess if you policies, procedures and processes comply with the <a href="https://gdpr-info.eu/art-5-gdpr/" rel="nofollow noreferrer">principles</a>. For the particular application is it:</p>
<ul>
<li>“specified, explicit and legitimate purposes”?</li>
<li>“adequate, relevant and limited to what is necessary”</li>
<li>“kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”</li>
<li>“processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures”</li>
</ul>
<p>And can you clearly demonstrate compliance with the above?</p>
<p>Just a personal observation: WTF are you using a spreadsheet for what is clearly a database problem? This is several dozen steps away from best practice data security.</p>
