Data Ownership
OnGuard's policy on data ownership emphasizes the importance of managing and protecting personal data in compliance with corporate security policies and regulations such as the GDPR. Key aspects include:
- Access Control: OnGuard enforces strict access control measures, including password enforcement and support for single-sign-on for certain applications. System access is restricted based on user roles and responsibilities, ensuring that only authorized personnel can access sensitive data.
- Data Management: The system allows for the segmentation of hardware, location, application, and functions, as well as reading and editing rights. This ensures that data is managed according to the user's functional responsibilities.
- Data Retention and Deletion: Data retention is determined in accordance with corporate security regulations. OnGuard does not provide a default deletion period but allows the possibility to define it. Appropriate permissions are required to delete data.
- User Control: The optional OnGuard Credential Self Service allows individuals to change their pin-code, request visitor access, and view their access rights. This empowers users with the right to control their data.
- Compliance and Monitoring: OnGuard Policies tool ensures the system is correctly configured to enforce corporate security policies. It monitors compliance and automatically corrects non-compliant access rights.
Data Portability
OnGuard supports data portability, which is a key requirement under the GDPR. This includes:
- Data Portability Rights: Users have the right to receive their personal data in a structured, commonly used, and machine-readable format. They also have the right to transmit that data to another controller without hindrance.
- Data Exchange: OnGuard's DataExchange license allows for the secure exchange of data between systems, facilitating data portability and integration with other systems.
- User Consent: For applications like OnGuard Visitor Self Service and BlueDiamond Mobile, a consent button is included to aid users' understanding of their data usage, application, and storage duration. This ensures that data portability is conducted with user consent.