On this page
- 1. Know where personal data is
- 2. Delete on time
- 3. Limit access to a purpose
- 4. Log access to personal data
- 5. Answer a subject access request in a month
- Where your documents are kept
- What is still yours to do
- When someone asks for their data
- What each right asks of the system
- Ten requirements to hold a system against
- What your DPO and IT will want to know
A policy answers GDPR's demands on paper. Settings answer them in the system. Each of the five parts below is set up in M‑Files, and each names the requirement it covers on the ten-point list of GDPR requirements put to case and document management systems.
1. Know where personal data is#
Every other GDPR setting depends on being able to say which documents contain personal data, and about whom. Without that you cannot delete on a schedule, restrict access by role or answer a request about a person.
Two decisions, taken once, settle it. The kinds of document that carry personal data (employee file, application, appraisal, employment contract) are marked as such, and each document is linked to the person it concerns. Everything about one person then comes back in a single search, wherever it was filed. Where a vault is not set up that way, a search on name or personal ID number finds the documents anyway.
Requirements 3 and 5 of the ten: deleting data, data classification.
2. Delete on time#
Personal data is kept no longer than the purpose requires. Your policy sets the periods; the vault is what keeps to them without anyone having to remember. Because each document is linked to the person it concerns, the system can clear up after itself.
A deletion rule can sit on a single document, on a kind of document or on a field value. Sensitive data about an employee, for instance, is deleted a set period after they leave (typically six months), with a notification beforehand or a view of the deletions coming up. The rule reads a date and deletion runs automatically. The spreadsheet of "what to delete when" goes away.
Requirements 6 and 7 of the ten: deletion rules, automatic deletion.
3. Limit access to a purpose#
Only people who need personal data for their task may see it. Access rules decide who a document exists for, just as deletion rules decide how long it exists.
The rules sit on the kind of document and on the person. An appraisal is visible to the employee, their manager and HR, and access follows when those details change. No folder permission is left over that someone set years ago and nobody reviews.
Requirement 1 of the ten: access control.
4. Log access to personal data#
Under GDPR, accountability means being able to document afterwards how personal data has actually been handled.
M‑Files logs every change to a document and its fields, every download and upload, deletions and each step of an approval. The event log can be filtered, searched and exported, which is what an internal audit or a regulator asks for. With M‑Files' advanced logging module, the log also records each time a file is opened.
Requirement 2 of the ten: logging of access.
5. Answer a subject access request in a month#
A person may ask what data you hold about them and receive a copy, usually within one month. That request is where the other four settings are put to the test.
Because documents about a person are linked to that person, the request becomes a search and an export: documents in their original format or as PDF, other data in Excel. And what a deletion rule has already removed is not there to be found.
Requirement 4 of the ten: data export.
Where your documents are kept#
Where M‑Files runs is a decision of its own, apart from the settings inside the vault: in the cloud, on-premises or as a hybrid of the two. M‑Files Cloud is hosted in Microsoft Azure, and data there is encrypted both at rest and in transit.
File data and the database itself can be encrypted, and communication with M‑Files can be set up to run over a secure connection.
Requirements 8 and 9 of the ten: encryption of communication and databases.
What is still yours to do#
A setting enforces a decision; it does not make one. The retention periods are yours to decide and to write down; the deletion rules then hold you to them. The roles are yours too: who needs access to what comes from you. The records of processing and the data processing agreements stay on your desk as well, because the system holds documents, not your compliance programme. None of this is legal advice, so check your own policy with your DPO.
Two pages take it further: compliance and risk for how this is delivered as an implementation, and security and compliance for the platform controls underneath.
When someone asks for their data
-
Request received
A person asks what data you hold about them. GDPR gives you, as a rule, one month to answer.
-
Find everything
One search on the person brings back the documents linked to them. A search on name or ID number covers anything that was never linked.
-
Export
Documents export in their original format or as PDF, and other data to Excel.
-
Answered
The person receives a copy. If they also ask to be deleted, the documents can be completely deleted.
What each right asks of the system
GDPR gives people rights and gives you duties. Each one lands on a setting in the vault, and this is the plain mapping.
Right of access
A person may ask what you hold about them and get a copy. In the vault that is a search on the person and an export: documents in their original format or as PDF, other data in Excel. The event log can be exported too, if they ask what was done with their data.
Right to rectification
A wrong date of birth or address is corrected in the fields or in the document. M‑Files keeps every change as a new version, so the corrected record is what people open and the earlier state stays in the history.
Right to erasure
Deletion rules do the routine part: workflows archive or delete documents after a set time, and a workflow can notify someone or ask for a review before a document is deleted. Deletion in M‑Files first hides the document; destroying it for good is a separate step, which matters when someone asks to be forgotten.
Access limited to a purpose
Only people who need personal data for their task may see it. Access rights follow the document's metadata, so an appraisal inherits the rule for its kind and for the employee it concerns, wherever it appears.
Accountability
You must be able to show afterwards how personal data was handled. The event log records changes, downloads and deletions and can be filtered and exported. With M‑Files' advanced logging module, the log also records each time a file is opened.
One month to answer
A subject access request must normally be answered within one month. The search, the export and the log above are what make that a routine task rather than a week of looking.
Ten requirements to hold a system against
Ten requirements are put to case management and enterprise content management systems under GDPR. Nine are settings, from access control to encrypted databases, and the five parts of this guide name them one by one. The tenth is a plan for keeping up with the regulation, and it is yours to make. Our M‑Files and GDPR page goes through how M‑Files meets each one.
