In this annex, within the meaning of Art. 40 (8) (d) DSA, it must be described that and which "appropriate technical and organisational measures" have been taken to protect the pbD in relation to the risks of the research project.
If the research project is carried out within a research organisation, the research organisation should already have documentation of the TOM for its infrastructure. In such cases, it is possible to attach the research institution's TOM documentation to the application for data access and to document in this annex only the measures that have been taken additionally for the specific research project. Similarly, the contents of the research organisation's TOM documentation can be included in this appendix and used as a basis for creating separate comprehensive documentation for the specific research project. If the research organisation has not documented its TOMs (centrally), or if the researchers are carrying out their project in an infrastructure operated on their own responsibility (for which there are no TOMs to date), this appendix must in any case contain complete documentation of all TOMs.
There are no legal requirements as to how and in what detail the TOMs are to be presented. The following presentation is therefore a suggestion in terms of structure and depth, which can also be designed differently (a very detailed sample is available, for example, from the Bavarian supervisory authority,
https://www.lda.bayern.de/media/checkliste/baylda_checkliste_tom.pdf).
The examples listed in the next step are measures that are typically taken in research operations. The examples are not to be understood as exhaustive, complete or universally applicable (some are alternatives) – they serve as guidance and must all be checked to see whether they are relevant to the specific research project. All examples that are not applicable should be deleted or amended as appropriate, and any missing information should be added.
With regard to the wording of Art. 40 (8) (d) DSA, the focus of the measures to be taken is on data confidentiality and security ("are able to comply with the specific data security and confidentiality requirements associated with each request and to protect personal data"). From the perspective of the data subjects , the other risk scenarios (data not available, incorrect, etc.) are generally only relevant insofar as the measures also concern the disclosure/transfer of their data. Beyond that, it is of little significance to the data subjects if their data is not available for research purposes. For the researchers involved, however, the availability and integrity of the data are the very basis of their work. Not least in their own interest, they should therefore ensure that strong security measures are also taken under 2. and 3.
