Table of Contents Table of Contents
Previous Page  109 / 192 Next Page
Show Menu
Previous Page 109 / 192 Next Page
Page Background


Appropriate Steps

Use of






• carry out risk assessments to determine an

organisation’s real need in using PSDs

• develop policies on the use, distribution and

disposal of PSDs

• limit and control the circumstances of

downloading specific types and amount of

personal data to certain types of PSDs under

specific conditions by predefined users

• apply proper access controls (both logical and

physical) and/or encryption to protect personal

data in PSDs when applicable

Bring your

own device


• carry out risk assessments to determine an

organisation’s real need in BYOD and its

technical capability to manage it

• develop BYOD policy to cover the following

specific areas:

– roles, responsibility and obligation of

organisations and individual users

– what criteria organisations would use to

allow personal data to be accessible

by/held in BYOD equipment

– security measures to protect personal data

collected and held by the organisation that

is being accessed/held by BYOD


– ways in which the personal data privacy of

the BYOD owners (and those who use the

BYOD equipment for personal use) may be


• extend organisational retention, secondary

use, security and data access/correction

policies to cover personal data held in BYOD

equipment where appropriate

• periodically review and assess BYOD policy to

keep up with technological development and

business practice