DP013Separation of program data

The keeping of the program’s own holdings apart from the systems the organization runs its business on, so that a case file is not reachable by whoever can reach the human resources record, and the stated conditions on which something crosses from one to the other.

Pillar: DP | Data and asset protection
Sources cited: 5
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
DP013/LUMandatory	Luxembourg	Délibération n° 11FR/2021Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026	That location data kept two years and four months for geographic tracking, protection of goods, and working time of travelling employees exceeded what the purposes needed, that a retention set per purpose is owed, two months for location, one year for billing evidence, three years for working time, that the employees were not informed as article 13 requires, and that access to the geolocation software through shared accounts breached article 32, individual accounts being owed only to those for whom access is strictly necessary to their tasks.	Individual accounts on the monitoring system only for those whose tasks strictly require access.
Recommended	Germanywhere written	IT-Grundschutz-Kompendium, Edition 2023Bundesamt für Sicherheit in der Informationstechnik · read 29 Aug 2026	What the German federal authority holds to be the state of the art, in numbered requirements, among them the checking of a candidate’s own account of themselves, a logging infrastructure the administrators who run it cannot alter, a regular audit of the detection systems against the state they are supposed to be in, and how evidence is secured.	The collected security relevant data are to be held centrally, as a log server assembly placed in a network segment set up for the purpose, and the administrators who operate it should hold no entitlement to alter or delete what it has recorded. The separation is of the store from the estate it observes and from the people who run that estate.
Recommended	Portugalwhere written	Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026	That the employer defines rules of use and forms of control in an internal regulation, heard by the comissão de trabalhadores and sent to the ACT, after assessing the impact; that the worker is informed before processing of the conditions of private use, the forms of control, the data, the retention period, the tolerance admitted, and the consequences; that control data are kept at most six months save during disciplinary or judicial proceedings; that email addressed to the worker is never opened automatically, even to investigate a disciplinary infraction; that control is not permanent or systematic but pontual, directed to areas of risk, and random; that access to a mailbox is the last resort, in the presence of the worker and preferably of a representative, limited to recipients, subject, date, and time; and that access to the monitoring systems is logged with user, timestamp, operation, sequential id, and hash, signed, analysed under a policy with periodic reports, and the logs kept one year.	A specific access profile exists for the control purpose, access is only by accounts that identify the individual univocally, and the servers hold a record of access to the sensitive information for internal and external audit.
Recommended	Switzerlandwhere written	Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026	What counts as a behaviour monitoring system (cameras in work rooms, microphones, continuous positioning, IT tools that monitor computer or phone activity at work or at home, sensors capturing biometric or physiological data, and AI tools for automated analysis of employee-based data), the three conditions of admissibility of a system needed for other reasons (a clearly overriding other interest, proportionality, and the participation of employees in planning, installation, hours of operation, and retention), the written justification produced to the labour inspectorate on request, and the data rules (prior detailed information, shortest predetermined retention, access limited to those authorized to evaluate, no archiving after the control, an internal regulation on rights and duties, monitored areas marked).	Access to the collected monitoring data is regulated internally and limited to the persons authorized to evaluate them.
Recommended	United Kingdomwhere written	Employment practices and data protection: monitoring workersInformation Commissioner's Office · read 30 Aug 2026	What the British regulator expects of an employer that watches its workers, told apart as what an employer must do and what it should, and the conditions it sets on watching them without telling them.	Access to what monitoring produces should be restricted to the people who need it, the most appropriate people to hold it should be identified rather than assumed, and they should be trained to handle it. The security risks of the monitoring itself should be assessed and the measures decided from that assessment.