A newsletter list needs a different level of protection from health data under Article 9 GDPR. We size the work to the type and volume of data and do not build defences your actual risk cannot justify.
We walk through the places where personal data really lives: payroll in BMD or DPW, the CRM, the ERP, SharePoint and OneDrive, network drives, mailboxes and the notorious Excel exports saved on laptops. The result feeds straight into your record of processing activities, which often still lists systems that were switched off years ago.
Front desk staff have no need to see salaries, and sales has no business in sick-leave records. Access is granted through groups in Entra ID or Google Workspace rather than person by person, so every change of role stays traceable.
Accounts like “office” or “admin”, with the password on a sticky note by the screen, are replaced by personal accounts with multi-factor sign-in. Every look at a record can then be tied to one individual.
We activate the Microsoft 365 audit log and file access auditing on the file server, with retention long enough to show weeks later who opened a particular file.
For access, erasure and portability requests we prepare the technical groundwork: saved content searches in Microsoft Purview, export routes from the CRM and a checklist of every system that must be searched.
A process agreed with HR ensures access ends on the last working day, including cloud services that are not linked to the directory, such as the recruitment portal or time tracking.
One page for the first hours: who assesses the incident, how the data protection officer is informed, which logs are preserved and what the person drafting the DSB notification will need.
We start where a small effort removes a large share of the risk. Bigger projects come once the basics are in place.
A video meeting with whoever is responsible for data protection, plus a remote look at your environment. You receive a list of systems holding personal data and how each is protected today.
Accounts of former staff, shared logins and sign-ins without a second factor disappear within the first few days. It costs little and the effect is immediate.
Laptop encryption, logging, a permission structure and limits on external sharing, rolled out group by group so nobody suddenly finds a folder locked.
You get a description of every technical measure in place, phrased so it can go straight into the record of processing and any documents requested during a DSB inquiry.
What matters is not whether antivirus is installed, but whether you can show what you did. After a complaint or a breach, evidence counts: who had access, since when, which log proves it and when it was last checked. A correct setting without proof carries little more weight than no setting at all, which is why every measure we apply is recorded with a date.
With the system list from the data map: ERP, CRM, mailboxes, network drives and backups. In Microsoft 365 a content search finds emails and documents with his name or customer number within minutes; in the ERP you need an export of the master record. You normally have one month. Your lawyer or data protection officer should read the reply before it goes out.
Write to support@apply.at straight away, or to helpme@apply.at if you have a contract with us. We try to recall the message, preserve the logs and work out the scope. With that information your data protection officer or lawyer decides whether the DSB must be notified. The 72 hours start from the moment you become aware of the breach.
Legally, processors require a data processing agreement (AVV); whether a particular adviser counts as a processor is for your lawyer to judge. On the technical side we check what access outside parties really have, whether it is personal and protected by a second factor, and whether it is still needed. We frequently find logins belonging to suppliers whose contracts ended years ago.
Storing it elsewhere within the EU is not a transfer to a third country. Microsoft, Google and AWS let you choose EU regions, depending on the service and plan, although with providers based outside the EU it is worth checking sub-processors and support access. European providers such as Exoscale in Vienna, Anexia, Hetzner or IONOS make it even simpler. We verify where mailboxes, backups and applications are actually stored and document it for your record of processing.
That depends on whether a processing activity is likely to pose a high risk to the people concerned, for example large-scale handling of health data or systematic monitoring. The DSB publishes lists that help. The decision itself is a legal one; for the assessment we supply the technical description of systems, data flows and safeguards.
Tell us briefly which systems hold customer and staff data. We will reply with a first view of the weak spots we most often see in comparable businesses.
Your enquiry has arrived
Our reply reaches you within one working day. Outages that leave your staff unable to work are dealt with first.
We could not find that town. Try another spelling, or choose whichever provincial capital lies closest; as everything is handled remotely, you get the same service in all nine Austrian states.
