New Data security audit at target (2020)

On the one hand, the role of target Software Solution GmbH as a processor was examined more closely. Thus, one focus was on the audit of the automated IT processes and their documentation.

In 2020, target is again independently certified as having a good result. It says: "... Essential requirements and suggestions for improving the individual points were examined and - where possible - implemented. Due to the implemented measures, a clear improvement of the rating was achieved. Individual areas have to be reviewed regularly due to the constant changes in the systems and will therefore be part of the audit again in the coming year (2021) ..."

Among other things, the technical organisational measures (TOM) were examined, in detail for the sub-areas of admission and entry control, access control, data carrier control, storage control, user control, transmission / transport control, input control, recoverability / reliability / availability, data integrity, order control and evaluation / monitoring and organisational control.

Measures were defined and implemented with our data protection officer for each of the aforementioned sub-areas of data security. Further contingency plans were developed and the  directories of procedures were completed.

Another focus was the review of the contracts for commissioned processing with critical service providers and their TOM. A Controller Processor Agreement exists between these service providers and target in accordance with the current specifications of the Gesellschaft für Datenschutz und Datensicherheit e. V. (GDD). target ensures that the service providers are carefully selected with regard to data security. The data security measures of critical service providers are checked every 12 months at the latest, of other service providers every 24 months.

At target, data protection and data security is a topic that is treated with high priority and is continuously developed - depending on the technical possibilities.