GB/T 33770.2-2019Information technology service—Outsourcing—Part 2:Data protection requirements (English PDF)

Foreword

GB/T 33770 "Information Technology Service Outsourcing" is divided into six parts.

--- Part 1. General requirements for service providers;

--- Part 2. Data protection requirements;

--- Part 3. Delivery Center requirements;

--- Part 4. Unstructured data management and service requirements;

--- Part 5. Project management requirements of the contractor;

--- Part 6. General requirements for service buyers.

This part is the second part of GB/T 33770.

This part is drafted in accordance with the rules given in GB/T 1.1-2009.

Introduction

The connotation and extension of this part are relatively broad, and there are concepts and understandings that are easy to be confused and ambiguous. It needs to be explained to facilitate the standard provisions. Interpretation and application of standards.

0.1 benchmark

This section considers that personal information has similar characteristics to commercial data. In the collection, processing, and use, its security requirements, security mechanisms, security The whole strategy and the like are equal, and the same management method can be adopted, which is suitable for the IT service outsourcing organization to jointly observe and apply, and can also be other lines. Industry provides reference.

0.2 data

"Data" is a broad concept. In this section, it refers to information related to personal information and commercial data.

Intellectual property rights are extensive, complex, and have relevant regulations. However, there is a legal gap in the protection of intellectual property-related information.

Because this part of the information is similar to the characteristics of commercial data. Therefore, this section classifies intellectual property-related information into business data.

0.3 Business Data

"Business data" is also a broad concept with broad connotations. In this section, specifically sensitive business secrets or other things that need to be protected data.

0.4 Comprehensive database

This part of the definition of the comprehensive database is composed of structured, unstructured personal information, commercial data (including automatic processing and non-automatic processing) Do not constitute a logical database.

0.5 Data Management

Data protection is one of the management activities or behaviors for data and related resources, environment, management systems, etc.

According to management, "data protection" is covered. This part of data management involves personal information management and business data management.

Data management encompasses the entire lifecycle of data collection, processing, and use.

0.6 Data Security

The data security involved in this section refers to the confidentiality, integrity, accuracy, usability, authenticity, and availability of personal information and commercial data. Control and non-repudiation.

0.7 Data Management System

Refers to an organic whole that has a specific function and consists of several related elements. By integrating and coordinating resources, focusing on management elements, The target is now scheduled. The interaction between elements and elements, elements and systems, systems and the environment interacts with each other.

This section provides basic rules and requirements for personal information management and business data management to build a data management system and fully guarantee The rights of the data subject to ensure the stable and effective operation of related businesses.

0.8 Standard Architecture and Style

This part takes management as the main line, and is guided by the data life cycle to build a data management standard architecture, which is different from the quality management system.

Standard system, in order to agglomerate, integrate management elements, improve, improve, and control the data management system to ensure data security.

0.9 standard compatibility

This section is coordinated with international and domestic information security standards and other relevant standards, and is compatible with or integrated with these standards. Shi and run.

0.10 business continuity

While providing safety guidance, this part needs to ensure the continuity of business based on the reasonable circulation of data.

0.11 standard applicability

IT service outsourcing organizations are basically consistent with the data security attributes and characteristics of various organizations, and their security mechanisms and security policies are similar. However, this part is universal.

a) The data management rules in this part of the specification are not only the basis of IT service management, but also establish data management for the development of IT services. Benchmark

b) The data management rules of this part of the specification have common characteristics and can be interpreted and tailored according to the characteristics of the organization;

c) The difference between the characteristics of IT service outsourcing organizations and various organizations is the organization's business and management, and the data involved (including contract management). For this part of the scope;

d) This section is not only applicable to IT service outsourcing organizations, but also to other organizations, enterprises, businesses, social organizations, etc.

1 Scope

This part of GB/T 33770 specifies the data life cycle and data subject rights involved in data protection in information technology outsourcing services.

Basics in terms of profit, data manager, data management, management mechanism, data acquisition, data processing, security management, process management, emergency management, etc. Rules and requirements.

This section applies to organizations that select and provide IT services, evaluate and identify IT service delivery capabilities. Other organizations can refer to carried out.

2 Normative references

The following documents are indispensable for the application of this document. For dated references, only dated versions apply to this document. For undated references, the latest edition (including all amendments) applies to this document.

GB/T 22080 Information Technology Security Technology Information Security Management System Requirements

GB/T 22081 Information Technology Security Technology Information Security Management Practical Rules

3 Terms and definitions

The following terms and definitions apply to this document.