Deutsche Telekom therefore welcomes the fact that European legislators have recognized the importance of certifications. Article 42 of the GDPR calls for the introduction of data protection-specific certification procedures, as well as data protection seals and audit marks.
Each year, the central functions of Internal Audit, Group Privacy, and Central Security Management alone conduct numerous privacy and data security controls and audits. Risk-based controls are part of the privacy compliance management system. These controls examine, for example, whether only necessary data is stored (the data minimization principle) and deleted once the purpose limitation has expired. Further audits help safeguard the information and network technologies used within the Group. For example, the Group-wide implementation of authorization, privacy, and security concepts is reviewed to identify any potential gaps. Such gaps can arise from security deficiencies in software solutions. Once identified, these deficiencies are promptly addressed together with industry partners.
Audit activities cover not only internal units but also, as part of a risk-based approach, suppliers and service providers that process personal data on behalf of the Group. The results of the various controls and audits help ensure a high level of data protection and security. They either demonstrate the effectiveness of systems and processes or help identify and address any weaknesses at an early stage.
A certification is a process carried out by external, independent bodies such as TÜV, DEKRA, or auditing firms. It verifies whether specific requirements for products and services, their respective manufacturing processes, commercial relationships, people, and systems are met.
In 2014, auditors from Deloitte & Touche audited the effectiveness of Telekom's data protection-related Compliance Management System (CMS). The result: All measures described in the CMS are implemented effectively. On September 30, 2014, the auditors confirmed the effectiveness of the CMS for Deutsche Telekom AG, Telekom Deutschland GmbH and their majority-owned subsidiaries, as well as T-Systems International GmbH and its majority-owned subsidiaries.
In 2020, Deutsche Telekom defined the further development of its existing privacy-specific certification activities across the Deutsche Telekom Group as a strategic privacy objective. To support this objective, it analyzed the new certification offerings in the privacy field. Based on this market analysis and information exchanges with the responsible supervisory authorities and the accreditation body, Telekom developed a modular certification framework that aims to provide both comprehensive certifications of the privacy management system, such as ISO 27701, and product-, process-, and service-specific certifications under Article 42 of the GDPR within Deutsche Telekom. Numerous units in the Deutsche Telekom Group are already certified under ISO/IEC 27701:2019, and central functions promote and support the rollout to other interested units. At the same time, privacy experts continue to monitor and analyze developments in the market for certifications under Article 42 of the GDPR. In this way, the Group continues to strengthen its position as a pioneer in privacy-specific certifications in the telecommunications sector.
The central security management system and parts of Telekom Deutschland GmbH have been certified in accordance with the international ISO 27001 standard. This certification confirms compliance with security requirements for information management systems, products, customer interactions, and internal processes.
The Open Telekom Cloud is also certified under the Trusted Cloud Datenschutz-Profil for Cloud Services (TCDP). This assessment standard meets the privacy requirements of the Federal Data Protection Act for Cloud computing.
Through its involvement in the Stiftung Datenschutz, Telekom also actively supports the AUDITOR research project. As the successor to the Trusted Cloud project, it is currently developing a standard for the privacy certification of cloud services under the GDPR.
