Ready for the General Data Protection Regulation?
Review the legal situation
The GDPR isn't just about IT. Companies should also gather information about the data they store and use from a legal perspective. For example: How long is it retained, where is it stored, and how and why is it used?
Definition of «Personally Identifiable Information» (PII)
»At the conceptual level, it is necessary to define which personal data will be used. This involves creating a PII data model for the entire company, which serves as the foundation for the next steps.» “As a leading provider of managed security services, Rackspace delivers significant added value to our GCP customers,” explains John Foong, Managing Director of Partner Sales and Strategic Partnerships at Google Cloud.
Mapping Data to Business Functions
Companies must track what data is being used by which teams and for what purpose. They must also verify that each department uses only the data it needs.
Assign data to applications
The next step is to pinpoint the exact location of the data—that is, where it is actually stored. One way to do this is to use a matrix of data model entities for the applications. Each entry in the matrix should indicate whether the application creates, reads, updates, or deletes the data. In addition, the «journey» of the data through applications and systems, as well as copies of this data, must be traceable.
Assessment of Use Cases Under the EU GDPR
Companies should now identify potential use cases under the GDPR that involve personal data and assess their implications.This means answering questions from data subjects such as: «What are you using my data for?» Another requirement is the «right to be forgotten,» which usually requires changes to applications and databases.
Minimizing Security Risks
The next step is to assess the security risks associated with accessing the data. This must cover the business, IT, and operational perspectives. This helps identify numerous necessary measures, such as restricting data access, modifying the deployment architecture to include zones with enhanced security, or implementing technical safeguards like encryption.
Detection of Security Incidents
This step supplements security measures with intrusion detection and notifications. In the event of a breach, an impact assessment is required, which must be based on evidence. What information is needed for this, and how can it be proactively collected? According to the GDPR, the relevant authorities must be notified within 72 hours of an incident. To meet this requirement, the corresponding processes must be reviewed. Of course, full preparation for the EU GDPR involves more than just these points. But they represent the fundamental steps. Furthermore, they form the basis for a well-organized and business-oriented IT infrastructure. For example, they enable process traceability. This not only addresses questions related to the GDPR but also supports business objectives.
About Rackspace
Rackspace is the world's leading provider of IT as a Service in today's multi-cloud world. The company offers expert consulting and integrated managed services for public and private clouds, managed hosting, and enterprise applications. Rackspace partners with all leading technology providers, including Alibaba, AWS, Google, Microsoft, OpenStack, Oracle, SAP, and VMware. Learn more at https://www.rackspace.com/de-ch
