According to
art. 96 of Royal Decree 1720/2007 of 21 December , which approves the
Regulations for the development of Organic Law 15/1999, of 13 December, on the
protection of personal data, hereinafter "Regulation Of the average
security level, the information systems and data processing and storage
facilities shall be subject to an internal or external audit to verify
compliance "of Title VIII of the Regulation, at least every two years ,
adding that" To carry out such an audit whenever there are substantial changes
in the information system that may have an impact on compliance with the
security measures implemented in order to verify the adaptation, adequacy and
effectiveness of the same . This audit starts the calculation of two years
indicated in the previous paragraph.
It is said
later that the audit report should be available to data protection agencies but
does not indicate how long these reports should be kept.
The art.
44.3 h) of Organic Law 15/1999, of December 13, on the Protection of Personal
Data , hereinafter LOPD , Indicates that "it is a serious violation to
keep the files, premises, programs or equipment containing personal data
without due security conditions that are determined by regulation ". Such
infringement shall be subject to two years of its commission, as provided in
art. 47.1 Of the LOPD. Thus the requested entity should always have at the
disposal of the Agency a report issued during the two years prior to the moment
in which the request is requested.
Comments
Post a Comment