A company plans to transfer employee health information between two of its entities in France. To maintain the security of the processing, what would…

According to Article 32 of the GDPR, the controller and the processor shall implement appropriate

technical and organisational measures to ensure a level of security appropriate to the risk, including

the pseudonymisation and encryption of personal data. Encryption is a key security measure to

protect the confidentiality, integrity and availability of personal data, especially when it is transferred

between different entities or locations. Encryption ensures that only authorised parties can access

and modify the data, and prevents unauthorised or unlawful access, disclosure, alteration or

destruction. Encryption also reduces the risk of data breaches and the potential harm to the data

subjects. Therefore, encrypting the transferred data in transit and at rest would be the most

important security measure to apply to the health data transmission. Reference:

Article 32 of the GDPR

IAPP CIPP/E Study Guide, page 58