How padoa meets legal and regulatory compliance requirements
padoa takes a proactive, systematic approach to implementing the requirements of the General Data Protection Regulation (GDPR). Guided by the recommendations of the competent data protection authorities and by our ISO 27001 and ISO 27701 certifications, we maintain a high standard of data protection and information security. That means sensitive data held by occupational health and safety service providers is processed confidentially, securely and lawfully at all times. To support GDPR-compliant processing, padoa provides built-in functions for managing information notices, consent and objections. Alongside these, our compliance pack is updated and developed continuously. Every relevant document and piece of information is available to service providers transparently and at any time. This gives padoa's clients a dependable basis for meeting data protection and regulatory requirements. They gain confidence in discharging their legal duties, reduce administrative work and can concentrate more on their core business without compromising on compliance or data protection. Margaux Jaumot, Head of Legal and Data Protection Officer at padoa in France
👉 SUMMARY
The legal framework for data processing under the GDPR
The sector-specific legal framework for occupational health and safety
padoa's certifications
Hosting in Europe
padoa's system stability is maintained by an in-house SRE (Site Reliability Engineering) team of 18 experts who continuously develop and maintain a reliable, scalable architecture.
This combination of human expertise and modern IT allows padoa to process data efficiently and to keep the data the services manage as secure as possible.
+38* compliance documents made available to clients in 2024
*Figure from the "compliance pack" available to clients in France since June 2023.
The legal framework for data processing under the General Data Protection Regulation
Meeting legal and regulatory compliance requirements
padoa is fully GDPR-compliant and helps its clients meet their own data protection obligations directly, through a comprehensive set of resources:
Functions built into the application. padoa supports the lawful recording, management and tracking of consent and objections, and supplies employers and employees with the required information automatically.
A record of processing activities in padoa's role as processor. This documents every relevant processing activity in full, including the purposes of processing, the categories of personal data and data subjects, the recipients of data, the sub-processors used, international transfers, retention periods and the technical and organisational measures protecting the data. The legal basis for each processing activity and the way data is collected are also documented transparently.
Thorough vetting of our own sub-processors. padoa reviews every sub-processor it uses carefully, both for GDPR compliance and for the technical and organisational measures protecting personal data.
A structured incident management procedure for incidents involving personal data, with defined processes for notifying the client.
This joined-up approach means we meet the requirements of the GDPR and offer our clients the highest standards of transparency, security and confidentiality in processing data.
The sector-specific legal framework for occupational health and safety
padoa fully complies with the statutory provisions governing occupational health and safety and with the particular protections applying to patient data. We commit contractually to maintaining that compliance for our clients on an ongoing basis.
The digital employee health record in particular adheres strictly to the legal requirements and to the most demanding data protection guidance issued by the authorities. That safeguards highly sensitive health data and gives legal certainty over digital documentation obligations.
The data protection authorities publish dedicated guides for checking whether occupational health applications comply with the GDPR. padoa meets those requirements in full.
padoa's certifications
The platform holds its own ISO 27001 and ISO 27701 certifications.
ISO 27001 is the leading global standard for information security management systems (ISMS) in IT. It applies to any organisation that manages sensitive data, including on behalf of third parties, and sets out a strict body of best practice for raising the security of IT systems to the highest level.
ISO 27701 extends that standard specifically to the governance and implementation of measures protecting privacy in the processing of personal data.
This certification confirms that padoa takes data protection requirements into account systematically while developing its software, following the principle of privacy by design. It is important evidence that our processes and systems are built to comply with data protection law.
Hosting in secure data centres in Europe
Protecting highly sensitive health data calls for a hosting infrastructure that meets the highest European security standards.
The platform is therefore hosted in data centres at several locations across Europe.
This clear division of responsibilities allows padoa to concentrate fully on developing, running and continuously improving its occupational health and safety platform, while clients benefit from secure, highly available and scalable hosting. padoa combines specialist expertise with the demands of data protection, information security and dependable platform operation.
💡F.A.Q
Confidentiality
How does padoa ensure data stays confidential and secure?
padoa relies on a comprehensive security framework to protect sensitive health and personnel data. That includes modern encryption, hosting in France on HDS-certified infrastructure, and strict access and permission controls.
Our ISO 27001 and ISO 27701 certifications underline how much weight information security and data protection carry at padoa. They confirm that the corresponding management systems are in place and are developed continuously.
Legal requirements
How does padoa meet the legal requirements for IT security and data protection?
padoa relies on a comprehensive security framework to protect sensitive health and personnel data. That includes modern encryption, hosting in France on HDS-certified infrastructure, and strict access and permission controls.
Our ISO 27001 and ISO 27701 certifications underline how much weight information security and data protection carry at padoa. They confirm that the corresponding management systems are in place and are developed continuously.
