Varstvo podatkov v programu za obračun plač v oblaku

Dolenc, Zala (author), Berce, Jaroslav (mentor)

Diplomsko delo obravnava Splošno uredbo EU o varstvu podatkov in spremembe, ki jih prinaša za upravljalce in obdelovalce osebnih podatkov. Raziskava temelji na analizi zakona in smernic podanih s strani drugih organov s poudarkom na zahtevah, ki jih morajo upoštevati razvijalci programskih rešitev. Ugotovitve so obravnavane na konkretnem primeru programa za obračun plač. Cilj analize je podati smernice za razvoj novih tehnologij in dopolnitev obstoječih rešitev tako, da so v skladu z varovanjem osebnih podatkov po Uredbi in ohranjajo zasebnost posameznikov v informacijski družbi. Analiza rešitev je narejena s t.i. oceno učinka, ki je predpisana metoda analize v uredbi. Ker program za obračun plač obdeluje izredno občutljive osebne podatke, je priprava ocene učinka po uredbi obvezna. Metodologija ocene učinka ni eksaktno določena z uredbo, zato se določi naslednji postopek:1. Opredelitev konteksta, 2. Analiza tveganj, 3. Ukrepi za obvladovanje tveganj. Glede na oceno učinka smo zaključili, da je potrebno v analiziran primer programa vključiti naslednje dopolnitve: dodajanje informacije o beleženju potrditev o obdelavi osebnih podatkov od posameznika, dodajanje tehničnih in vsebinskih kontrol na ključnih procesih obdelav, redno arhiviranje in zaščita vseh baz podatkov, logiranje uporabnikov v program in beleženje zgodovine sprememb na podatkih.

• Language: Slovenian
• Keywords: Splošna uredba EU o varstvu podatkov, razvoj programskih rešitev, ERP sistemi, program za obračun plač, občutljivi osebni podatki
• Work type: Bachelor thesis/paper
• Organization: FDV - Faculty of Social Sciences
• Year: 2018
• PID: 20.500.12556/RUL-104813
• COBISS.SI-ID: 35994205
• Publication date in RUL: 12.10.2018

Secondary language

• Language: English
• Title: Data Protection in Cloud Payroll Software

Abstract

This thesis focuses on the EU General data protection regulation and the resulting changes with respect to the operators and personal data processors. The research is based on the analysis of the act and guidelines submitted by other authorities with an emphasis on the requests to be respected by software solution developers. The findings have been shown at a concrete example of a payroll accounting programme. The aim of the analysis is to provide guidelines for the development of new technologies and amendments of the existing solutions so as to comply with data protection according to the regulation and maintain privacy of individuals in the information society. The analysis of solutions is based on the so-called impact assessment which is the method of analysis provided for by the regulation. Since personal data processed by the payroll accounting programme are extremely sensitive, the impact assessment prescribed by the regulation is mandatory. However, the regulation does not exactly define the methodology of the impact assessment; therefore the following procedure has been established: 1. Definition of context; 2. Risk analysis; 3. Risk control measures. According to the impact assessment, we have concluded that the following amendments must be included in the example programme analysed: inclusion of information on the registration of confirmations of personal data processing provided by individuals; inclusion of technical and substantive controls on key data processing processes; regular archiving and protection of all databases; logging of users into programmes; and recording of history of data changes.

• Keywords: General data protection regulation, development of sotfware solutions, ERP sistems, payroll software, personal data