In derogation from GDPR Art. 9(1), special categories may be processed by public and private bodies where necessary for social security and social protection rights and duties; for preventive or occupational medicine, judging an employee's fitness for work, diagnosis, care or treatment in health or social services or running those systems, or under a contract with a health professional, by persons under professional secrecy; for public health reasons with professional secrecy observed; or where urgently necessary for substantial public interest. Public bodies may also do so to avert a serious danger to public security, to avoid serious damage to the general good, or for urgent defence and crisis purposes. For the last ground of public and private bodies and for the public-body grounds, the controller's interest must outweigh the data subject's. In every case appropriate specific measures are required, chosen by state of the art, cost and risk: technical and organisational measures, logging of who entered, changed or removed data, staff awareness, a data protection officer, access restriction, pseudonymisation, encryption, confidentiality, integrity, availability and resilience with rapid restoration, regular testing of measures, and specific rules for transfers and further use.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.