BORA Business Suite compatibility with GDPR

The new features are put into operation as:

Instruction

 

The main GDPR participants as roles in BORA BS

 

As an extended ERP system, BORA BS reflects the GDPR requirements through user roles, as follows:

Data subject      

Personal data of individuals is stored in three topic  areas:

• Customers and suppliers as individuals / legal entities

• Contact persons of legal entities

• Employees

Personal data

The personal data collected in BORA BS is the problem-oriented data required for trading operations or for staff administration.

Personal data controller

To carry out the internal control functions  of the personal data controller, access to Administration/Access Register/Events is enough.

Instruction: Make the person you have chosen,(a)  with the role “Personal data controller”,  a member of group (9) “GDPR Supervisory Authority” for internal audit.

Administration/Users/Rights by group: GDPR Supervisory Authority

Instruction: Set up the e-mail of a group or person to receive messages about events related to changes in access rights, the DSR status of persons, anonymisation and pseudonymisation events and so on.

Administration/Global Settings/Administration: “014-02 Group for sending messages on events in the Event Log (GrpMailTraceLog)”

Data protection officer

A new function has been created: (DPO) “Data protection officer”, mainly  in the personal profile of users (3) “Entering counterparties”, for “Setting rights to maintain personal data under GDPR”

Instruction: Enable in the profile of  the persons you have chosen the (DPO) “Data protection officer” function

Administration/Users/Functions: Data protection officer

Supervisory authority

A new user group has been created: (9) “GDPR Supervisory Authority”, to give access for the purpose of  an audit by an “independent public authority”,  with the powers of a “national data protection authority under the current EU data protection directive”

Instruction: Create a user for the supervisory authority and make it a member of group (9) “GDPR Supervisory Authority” for external audit.

Administration/Users/Rights by group: GDPR Supervisory Authority

Technical measures to protect personal data in BORA BS

BORA BS  covers the GDPR recommendations with technical means, providing several layers of protection for personal data at rest and in exchange with users.

Encryption

BORA BS provides encryption (hashing and encryption)  at the level of:

• Network structure:  through firewalls and encryption of the data exchanged between the client and the database.

• Database: critical data, to prevent unauthorised user access to the features of BORA BS

  BORA BS stores personal data for business activities mainly in these pools: Users (Users), Counterparties (Contragents) and Persons (Persons)  and for serving employees in the pools: Personnel (Employee), Salaries (Salary) and Payrolls (Payroll)

Anonymisation and pseudonymisation

Anonymisation and pseudonymisation in BORA BS are applied to copies of the database, for the purposes of developing, testing and supporting the system.

Every production  database has a copy with _DEMO in its name  for training and testing at the installation of  the user, which is fully functional for a limited number of users.

The DEMO database is anonymised or pseudonymised in cases where it needs  to be moved to the development environment of the product’s developer. BORA Solutions  does not keep copies of users’ production databases.

Instruction: Make a copy of BORA BS … Production DB, following the current instructions, as BORA BS … DEMO DB. Run the anonymisation or pseudonymisation in … DEMO DB.

Administration/Access Register\Anonymisation and pseudonymisation

Privileged control of user access

BORA BS users with access to personal data are in groups:

• Active: creating and updating personal data

• Passive: viewing data to support trading processes or to serve the person.

Active users are usually involved in trading or financial processes that concern the person, and they create records.

Another group of users handles employment relations with staff.

The BORA BS policy for controlling access to the system’s features is carefully organised to prevent unauthorised access  to features, and through them to data.

• Access  to the system is protected by a password that is encrypted and has managed complexity.  Linking the user name (User Id) to a specific employee and all changes to the user profile, such as blocking access or setting a time window for work, are recorded in the “Event register”
  

• Features are grouped by topic in “User groups” and are used in a limited way as licences, which are  controlled in  an encrypted table.

• The applications, the menu system, for serving a given user group  of BORA BS are organised in controlled encrypted tables.

• Breaking the integrity of the access control environment blocks the system.

Precisely controlled access management

The “Data protection officer” in BORA BS  is the only one with access to manage the status of the main records, following written  instructions from the personal data controller, such as: 

• Editing personal data

• Hiding  personal data
  

• Restricting processing

• Deleting  personal data

Master Data/Counterparties: Personal data

Master Data/Persons: Personal data

Data minimisation

The personal data entered and stored  in BORA BS relates only to what national legislation and regulations require:

• Data for handling the trading and financial flows of information

• Data for  handling the employment relationships with employees

Administration/Access Register

Administration/User Productivity

Administration/Event Register

Monitoring to detect breaches

Running BORA BS involves constantly creating and updating records in the database and transferring data to and from external environments (B2B).

Monitoring and timely warning

For process monitoring and control of personal data, every record is stamped with its creator and time, and with the last update. For data defined as critical, entries are made in the “Event history”, and the personal data controller is warned  together with the person concerned, so that unauthorised access is detected.

At the next level, access to each feature is traced for every user, with performance analysis.

Audit data

BORA BS gives an auditor access to view the “Access register” and the “Event register” to detect breaches

Administration/Access Register

Administration/User Productivity

Administration/Event Register

E-mail

Data subject rights (DSR)

GDPR lets data subjects exercise various rights (DSR) over their personal data, and they can

ask for better visibility of customer data in systems, so that all data can be found and removed on request.

Changing the data subject’s personal data

BORA BS keeps the main personal data as Counterparties: individuals, and general-purpose contact persons for carrying out business operations.  

Instruction: 1. Limit  the BORA BS users who are members of group (3) “Entering counterparties” to those responsible for the business operations that involve keeping personal data of individuals who are customers or  suppliers and contact persons.

                                2. Give rights to group (7) “Entering employees”  only to users involved in human resources.

Administration/Master Data/Counterparties

Administration/Master Data/Persons

BORA HR keeps the “Employee register”, where the roles for keeping personnel information, salaries and payrolls are precisely defined. The environment is highly configurable, not only in access to features but also in  access to areas of data, “Rights by object”

Administration/Users/Rights by user group:

(31) Work planning;

(32) Personnel;

(33) Payroll;

(34) Salary accounting;

(35) Time keeper;

(36) Recruitment and training

Administration/Users/Rights by object

Marking records as blocked for viewing and export

BORA BS users who are members of group (3) “Entering counterparties”  with the DPO function, “Data protection officer”, have access to (DSR), the record status of persons.

Instruction: (DPO) The data protection officer handles persons’ requests by setting the personal data record to one of these  states:

(1) Editing personal data, set normally

(2) Hiding  personal data

(3) Restricting processing

(9) Deleting personal data

Administration/Master Data/Counterparties

Administration/Master Data/Persons

Exporting the data subject’s personal data

BORA BS  makes it possible  to export to Excel, and in this way to access, personal data for review,  editing and import

Administration/Master Data/Counterparties~Environment, Export, Excel

Administration/Master Data/Persons~Environment, Export, Excel

Notification of the processing of data subjects’ activities

The actions of the data protection officer (DPO) in changing the record The record status of persons (DSR) are recorded in  the “Event register”, with the type “GDPR  Monitoring”  and sent as an e-mail message to two recipients:

1. The group (person) for sending messages that trace GDPR events

2. The person being monitored: the person who is the data subject, or the BORA BS user