GDPR and The Cloud – All you need to know about

GDPR Compliance

General Data Protection Regulation (GDPR) is Europe’s latest data privacy and security regulation that was issued by the EU commission in 2018. With the advent of technology, EU recognized the need for modernized safety measures and being GDPR compliant simply meant assuring rights to data privacy and protection.

It is one of the most rigorous data protection laws in the world. It has been levied at a time when increased number of people are allocating their data on cloud, which in turn is instigating larger privacy breach and violation occurrences. GDPR helps implement privacy policies that are resilient and transparent, enable informed consent for data collection, bridges gaps in business contracts around GDPR compliance and establishes GDPR controller & processor strategies.

Organizations that work with European businesses, involved in collection, storage and processing of sensitive data must ensure GDPR compliance even if they are based outside EU. Non-compliance leads to heavy fines from the EU commission, the hardest hit being multinational tech giants, listing over 2.8 lac reported data breaches in 2021 across the EU. A global law firm reported GDPR fines totaling to €272.5 million as of Jan 2021. Going by a GDPR checklist is the only way to curb non-compliance and save money in the long run.

Principles of GDPR

• Lawfulness, transparency and fairness – Ensures that an organization’s data privacy and processing is straightforward, easily accessible to view and edit and is not used for unethical means.
• Purpose limitation — Data to be collected for only viable purposes within the scope of business in the interest of its customers.
• Data minimization — Minimum amount of required data needed to run the business must be gathered, processed and stored.
• Accuracy — All the collected data must be accurate and updated. Incorrect and outdated data must be cleaned up at regular intervals.
• Storage limitation — Personal data that is identifiable must be stored only until required for business.
• Integrity and confidentiality — GDPR mandates storage and processing of data such that the integrity and confidentiality of information is contained.
• Accountability — Measures taken by organizations to ensure accountability in case of data breach to avoid non-compliance and minimize penalties.

6-step GDPR Compliance checklist

The best way to keep track of GDPR compliance efforts is for organizations to adhere to the GDPR checklist. The checklist invokes the GDPR principles to provide a roadmap to stronger compliance strategies. The checklist comprises of –

1. Conducting a cybersecurity risk assessment to identify vulnerable areas and incorporate risk management plan based on the findings.
2. Recognize alternate security and compliance standards that organizations may have already achieved or utilized to benchmark data security and privacy measures.
3. Appointing a data protection officer is a mandate for GDPR-compliant organization with more than 15 employees. The officer is responsible for monitoring and managing data by implementing the necessary regulatory controls.
4. Ensuring user consent for data collection, maintaining transparency in setting privacy rules and storage limits and allowing data deletion or non-subscription at any point of time.
5. Conduct GDPR audit post administering a basic risk assessment as per defined organizational benchmarks. Identify and bridge the gaps to sustain compliance efforts.
6. Setup data breach response cells and ensure contact within 72 hours of breach, with individuals’ whose data has been compromised. Response plan should state the who and how factors of the breach, along with any supporting documents needed while informing concerned parties about the breach.

Key factors that help organizations ensure GDPR compliance

• GDPR recommends encryption as a robust security measure to protect data. It minimizes exposure risk in case of a data leak or breach. For maximum protection, ensure that encryption keys are managed by the end-user, check if provider uses industry standard algorithms and look for end-to-end encrypted services.
• Implement account security measures in addition to data security and control. This includes managing user authentication with zero-knowledge password methods that provide a no compromise environment in case of a hack or data leak. Multi-factor authentication adds an extra layer of protection for identity verification through an alternate trusted device. GDPR makes it compulsory for organizations to implement comprehensive data confidentiality and integrity policies to enforce continual security practices. It provides granular level access to data, helps monitor audit trail of files, data security, backup and access revoke when required.
• GDPR provides transparency on data protection with clearly defined privacy policy and terms of use. Data must preferably reside in EU-based data centers and in case of third-country data center usage, additional data protection checks that are at par with EU defined GDPR standards must be implemented. Organizations must seek transparency reports on user data requests as well.
• Opt for EU-based cloud solution providers that offer stronger control over privacy of data and are certified under the EU-US Privacy Shield or other reasonable contractual guarantees to manage consent for data usage. Organizations should sign data processing agreement that cover legal guarantee of data protection in line with GDPR guidelines.
• GDPR is revolutionary as it helps organizations assess risks, analyze existing data protection practices and customize protection as needed. It implements holistic technical, legal and organizational measures to minimize risks taking into account other security and compliance standards like ISO and HIPAA. It also keeps a check on third-party information security audit performances.