scope:

This European Standard provides guidance on a High Level Security Policy for third country organisations and is restricted to aspects relevant to personal health data transferred from a compliant country to a third country (see definitions). This European Standard provides guidance on the High Level Security Policy which should be adopted by third country organisations involved in international informatics applications which entail transmission of person health data from an EU Member State to a non-EU Member State whose data protection is inadequate in the context of the EU Data Protection Directive [1]. Its purpose is to assist in the application of the EU Directive. The European Standard does not provide definitive legal advice but comprises guidance. When applying the guidance to a particular application legal advice appropriate to that application should be sought. Whereas this guidance will be useful in the formulation of a high level policy for EU organisations, its scope is restricted to organisations in third countries (see definitions).