Finland – IT services: consulting, software development, Internet and support – Palvelimien turvasäilö

The subject of the procurement is a solution that enables the provision of a secure, isolated and managed server storage for backup data. The solution must enable the secure storage, processing and utilization of backups in a separate entity, detached from the production environment. DATA PROCESSING AUTHORISATION, LOCATION, CONTROL RELATIONSHIPS AND PROTECTION The subject of the procurement, the server backup service, includes data replicated from the Customer's assurance environment, which may include, in addition to the Customer's own data, also patient information system data of owner-customers and thus personal data belonging to the special categories of personal data referred to in Article 9 of the EU General Data Protection Regulation. The processing of data belonging to special categories of personal data is generally prohibited, but processing is permitted when an exception has been provided for in the prohibition. In this service, processing is necessary for the management of healthcare information systems and services as well as for ensuring the continuity and recoverability of services (GDPR 9(2)(h)). Processing is carried out in accordance with the instructions of the owner-customers (data controllers); the Customer acts as a data processor and is responsible for the management of sub-processors (the Supplier with possible subcontractors). To ensure the data controllers' notification obligation, accountability and the high level of protection of the data to be processed, the Customer requires that: 1) backup data is stored and processed solely in data centres located in Finland, and 2) the management interfaces (maintenance and management traffic as well as possible remote management solutions) are only permitted from Finland, and 3) backup data is encrypted (in transit and at rest) and the service is produced solely in a dedicated environment for the Customer. The requirement is limited to cover only the backup service that is the subject of the procurement and is appropriate in relation to the objectives of the procurement and the nature of the data to be processed. OPTION Optionally, a quotation is requested for an analytics service (Isolated analytics environment with ransomware and virus scanning), which operates in a completely separate network segment without access to the production network. This service can be procured as needed during the contract period, which is why it is only included in the comparative quotation for one year.