Safeguards and storage periods
Article 8
1. The Commission, respectively the Appeals and Case Monitoring Unit of DG HR shall implement safeguards to prevent abuse and unlawful access to or transfer of personal data in respect of which restrictions apply or could be applied. Such safeguards shall include technical and organisational measures such as: (a) a clear definition of roles, responsibilities, access rights and procedural steps; (b) a secure electronic environment to prevent unlawful or accidental access to or transfer of electronic data to unauthorised persons; (c) a secure storage and processing of paper documents limited to what is strictly necessary to achieve the purpose of processing; (d) due monitoring of restrictions and a periodic review of their application. The reviews referred to in point (d) shall be conducted at least every six months. 2. Restrictions shall be lifted as soon as the circumstances justifying them no longer apply. 3. The personal data shall be retained in accordance with the applicable Commission retention rules, to be defined in the records kept under Article 31 of Regulation (EU) 2018/1725. At the end of the retention period, the personal data shall be deleted, anonymised or transferred to the archives in accordance with Article 13 of Regulation (EU) 2018/1725.