Manage and review the environment

After the rollout, regular administration remains necessary. This page lists the checkpoints, explains the organisation administrator's part in data subject requests, and ends with a checklist.

Periodic review #

Schedule a fixed review. How often depends on the size and risk profile of the organisation; quarterly is a common start.

Users

• Are all users still active and do they still need access?
• Are roles still correct?
• When someone left, was ownership transferred first, and were group access and key rotation dealt with?

Groups

• Are groups still active, or can they be archived or removed?
• Are the right people owner or admin?
• Are outside collaborators still needed?
• Is the agreed folder structure per group type still followed?

Information

• Are retention periods followed? Transfers and requests expire by themselves; Drive content and journals do not.
• Can old groups be archived?

Security

• Are the security settings still appropriate?
• Is single sign-on used correctly where it is set up, and have pending SSO members been handled?
• Are there security alerts or anomalies in the audit log that need follow-up?

Usage

• Is Databeamer actually used for the agreed processes?
• Are there recurring user questions, or features that stay unused?
• Are document types, labels and statuses used consistently, so the management information stays reliable?
• Does the organisation stay within its capacity? See Org Settings › Usage.

Personal data and data subject rights #

Groups may contain personal data. Responsibility for it lies with the organisation and, within it, with whoever is responsible for the processing in question. As organisation administrator you are not automatically responsible for the content of every group: the group owner is responsible for the information in the group and for keeping the agreements about it, including retention periods and data subject requests.

Under privacy law, data subjects may have several rights: access, rectification, erasure, restriction of processing and data portability. The exact conditions differ per situation.

The organisation administrator cannot carry out such requests organisation-wide alone. The content of groups is readable only by that group's members and therefore cannot be searched centrally for names or other personal data. Databeamer also has no fixed fields for personal data. An administrator therefore cannot establish in which groups data about a person occurs.

A request is therefore handled by the group owner or another person responsible for the content, who assesses within the group what information is present and what action is needed: for access, which data exists; for rectification, what must be changed; for erasure, what must be removed with statutory retention duties in mind; for restriction, which processing is paused; for portability, which data qualifies and how it is provided.

The organisation administrator supports from the organisational role: tracing the right group owner, coordinating the handling, updating the data-subject-request log. The substantive assessment and handling stay with the responsible person in the group.

Security detailsWhat is this?

That an administrator cannot search centrally is not a limitation of the software but a consequence of the design: file names, content, messages and journal entries are encrypted with the group's key set, which only members hold. The server cannot search them and neither can an organisation administrator. What administrators and the server can read, and so can oversee centrally: group names, member lists, document types, statuses and labels, and the metadata in the audit log. See Groups and Audit log.

Evaluate and improve #

A Databeamer environment is not a one-off project. After the introduction, questions come up, processes change and new use cases appear. Discuss periodically what goes well, where users get stuck, which processes could be simpler, where security risks arise, whether roles and access still fit, and which features could be used better. Improve the setup step by step.

A well-set-up environment is not the one with the most settings, but the one that helps users work securely and efficiently.

Checklist #

Before the start

• Purpose and use cases are defined.
• It is clear which information is processed through Databeamer.
• User groups and access needs are determined.
• Roles and responsibilities are agreed; administration does not depend on one person.
• The group structure is set, with a fixed folder structure per group type.

During setup

• Organisation details and branding are configured.
• Administrators and members are set up, with a second owner.
• Groups are created and owners appointed.
• Document types, statuses and labels are set up where needed, with agreements on closing and archiving.
• It is clear which management information is needed from journals.
• Single sign-on is set up where applicable.
• Security and privacy agreements are written down.

At the introduction

• Users know why and when they use Databeamer.
• Users have been told about their account, PIN and recovery phrase.
• Sharing and receiving files has been practised.
• The rules for secure use are clear.

In use

• Users and access rights are reviewed periodically.
• Groups are reviewed periodically.
• Retention periods and archiving are applied.
• The audit log is used where needed.
• Management information from journals is reviewed periodically.
• User questions and signals are followed up.
• The setup is adjusted when processes change.

As organisation administrator you are the link between technology, information security and daily practice. So make time not only for setting Databeamer up, but also for guiding users, checking the setup and keeping on improving its use.