System administrators and the Garante's order
Individual appointments, an up-to-date list, an annual review of their work and logging of access: what the 2008 order requires and how you cover it with generated appointment letters and logs collected from three sources.
The Italian Garante's order on system administrators
The order of 27 November 2008 issued by the Garante per la protezione dei dati personali (the Italian Data Protection Authority), published in the Italian Official Journal (Gazzetta Ufficiale) no. 300 of 24 December 2008 and amended by the order of 25 June 2009, requires data controllers to adopt specific measures for the people who administer IT systems.
A system administrator is anyone who manages and maintains the systems used to process personal data: servers, networks, security appliances, databases, management software. It can be an employee, but very often it is external: the IT supplier, the consultant, the software house that connects remotely. That is why the requirement concerns almost every company.
The order remains a reference point for the Garante even after the GDPR, because its measures are a practical way to demonstrate the security of processing and control over privileged access. For a technical deep dive into the logs, read the guide to system administrator logs.
The measures required for system administrators
They are organisational and technical measures at the same time. The former are documented with appointments and lists, the latter with logs.
- Prior assessment of the experience, ability and reliability of the person receiving the role
- Individual appointment, with a detailed list of the permitted areas of operation
- An up-to-date list of administrators, with identification details and assigned functions, available in case of inspection
- Outsourced services: the details of the individuals who administer the systems must be kept even when the service is entrusted to a supplier
- Disclosure to workers of the administrators' identity, when they process employee data
- Review of the work of administrators, at least once a year
- Logging of logical access to systems and electronic archives, with timestamps and a description of the event
- Logs that are complete, unalterable and with verifiable integrity, retained for at least six months
The full text is published by the Garante: order of 27 November 2008, updated text (in Italian).
Appointments and the list, without copying and pasting
A system administrator's appointment is individual: one letter for each person, with their areas. With GDPR forms you load the details of employees and suppliers once, from a CSV file too, choose the appointment template and the recipients, and download an archive with a completed document for each one, as editable DOCX or as PDF.
You can use our templates or upload your own, for example the one approved by your DPO. The same personnel records are used for the other GDPR appointments and privacy notices.
The list of system administrators, internal and external, is declared in the Access logs module, next to their logins. It is the document the order requires you to keep up to date and to produce on request.
For the annual review of their work, the Compliance and GRC module lets you record it as a recurring activity: when it falls due it reopens by itself, so it does not stay approved once and for all.
The access register, from three sources
Administrators today work on workstations, servers and cloud services. The register brings them all together in the same place.
Endpoints, with the Cyber Agent as SIEM
The Cyber Agent on PCs and servers centralises access logs: user, workstation, IP address, domain, host, outcome, whether the account is an administrator account, date and time.
Microsoft 365 and Entra ID
With the Microsoft Entra ID module, connected read-only, sign-ins to the tenant enter the register, with alerts on failed attempts, new countries and administrator accounts.
Google Workspace
If you work with Google, the Google Workspace module adds sign-ins to the domain's accounts, alongside those from the workstations.
Why logs must be kept out of the hands of the people who administer
A log that the administrator can delete from their own machine proves nothing. That is why the order requires the logs to be unalterable and their integrity verifiable.
The Cyber Agent sends the logs to a centralised collection point, outside the system that generated them, and retains them for up to six months. It also monitors file integrity on endpoints, so an unauthorised change shows up as an event. If your retention policy requires longer periods, the CSV export of the register lets you archive it regularly in your document management system.
The alerts can lead to a proposal to block a Microsoft account. The account is disabled only when a person confirms it: an automatic block could be triggered by anyone who knows a company email address.
Questions about system administrators
Who is a system administrator according to the Garante?
The person who manages and maintains a processing system or its components: servers, networks, security appliances, databases, complex management systems. What counts is the actual role, not the job title: even an external technician who works remotely can be one.
How long must system administrator logs be retained?
The order specifies a period of no less than six months. The logs must be complete, unalterable and with verifiable integrity, and include timestamps and a description of the event. If other rules or internal policies require longer periods, the longer period applies.
If IT is outsourced to a supplier, do I still have to appoint the administrators?
Yes. The order requires you to keep the identification details of the individuals who, at the supplier, act as administrators of your systems. In practice you need a list of names, in addition to the agreements with the supplier as data processor.
How is the annual review of their work carried out?
At least once a year the controller checks that the administrators' activity complies with the organisational, technical and security measures in place. The access register, with its alerts and export, is the basis for carrying out the review and documenting it.
Can the access register be handed over during an inspection?
Yes. The CSV export contains the complete register and can be attached as evidence, together with the list of system administrators and the individual appointments generated with the forms.
The modules for compliance
Access logs
System administrator logins collected and retained as the Italian Data Protection Authority requires.
Learn more SeeCyber Agent
The endpoint agent: security events, file integrity and clear, readable alerts.
Learn more GovernGDPR forms
Appointments, privacy notices and authorisation letters for all your staff, generated in one step.
Learn more SeeMicrosoft Entra ID
The security posture of your Microsoft 365 tenant across 72 indicators, read-only.
Learn more SeeGoogle Workspace
35 checks from the CIS benchmark on your Google Workspace configuration, email included.
Learn more ComplianceGDPR
Records of processing, appointments, Article 32 measures and data breaches.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.