Keeping Up with Data Protection Regulations

The growing reliance of many technologies and services on data, including sensitive and personal data, has raised the importance of protecting this data from theft, corruption, and loss. National and global authorities have stepped in with regulations such as the General Data Protection Regulation (GDPR).

Failing to meet the industry standards for data protection can result not only in lost or compromised data, but also in legal and financial penalties, as well as damage to the reputation of an organization. Read on to learn about data protection regulations and how you can comply with them.

In this article:
• What is data protection?
• What is GDPR?
• Data protection technologies
• How to achieve data privacy compliance
• Data protection with Cloudian storage devices

What Is Data Protection?

Data protection—sometimes referred to as information privacy or data security—is the process of protecting the privacy, integrity, and data availability of important information. Any organization that handles sensitive data must implement a data protection strategy to prevent the theft, corruption, or loss of their data and mitigate against the damage in the case of a security breach or disaster.

Recovery from a data breach or data loss is time-sensitive, and any delay can affect business continuity. There are also legal requirements for many industries, which apply to organizations that handle or store personal information such as names, addresses, passwords, credit card details, and medical records.

What Is GDPR?

The General Data Protection Regulation (GDPR) was adopted on April 2016 and came into effect on May 2018 with the goal of providing a unified standard for data protection across the European Union (EU) and European Economic Area (EAA). It stipulates that any organization, public or private, that processes personal data must commit to maintaining a high level of data security.

The GDPR emphasizes the rights of EU residents relating to personal data, including the right to access, modify, transfer, or erase their data. Personal data as defined in the GDPR refers to any information that relates to an individual. This encompasses Personally Identifying Information (PII), such as names; addresses; physical traits, including weight, height, and ethnic or racial characteristics; biometric data such as DNA and fingerprints; and health data.

The GDPR stipulates that organizations must provide transparency regarding their use of personal data, requiring them to disclose any data processing activity, demonstrate the lawful basis for using this data, and report any data breach within 72 hours.

Data protection is an essential part of GDPR, and almost all online businesses must comply with these or similar standards. GDPR compliance requires the implementation of a data privacy policy that ensures that only the necessary data is collected; that individuals have a say about which data can be collected and how it can be used; and that all sensitive data is deleted as soon as it has served its purpose. The penalty for non-compliance is a fine of up to €20,000,000 or four percent of the global revenues of an organization.

To help organizations meet the compliance requirements, the GDPR outlines responsibilities for roles such as Data Protection Officers (DPOs) and data controllers. Data controller responsibilities include implementing measures to ensure that personal data cannot be misused and that it remains confidential. The GDPR grants the data controller flexibility to implement additional data protection measures but requires the data controller to evaluate the risk and cost associated with them.

Read the Complete Guide to GDPR Compliance for Data Storage

Data Protection Technologies and Practices

There are a number of data management and storage solutions that can help you protect your data. There are several types of data security measures intended to restrict access to data, monitor activity in the network, and deploy a response to a suspected or confirmed breach. Some common technologies and preventative security measures include:

Data Backup—storing regularly updated duplicates of your data. This often involves “mirroring” your data in its entirety so you can access it from more than one place. You can utilize an on-premises disk-based storage system for a secure, local backup with quick access, tape as either local or remote backup, or cloud backup.

Data Loss Prevention (DLP)—a solution that utilizes several tools to help mitigate against data loss.

Firewalls—help you monitor network traffic so you can detect and block malware.

Authentication and authorization—confirming the identity of a user and validating the access privileges of the user. A combination of credentials (i.e. passwords), access tokens, and authentication keys help provide an added layer of security. This can be part of a larger Identity and Access Management (IAM) solution, along with measures like Role-Based Access Control (RBAC).

Encryption—converts the data into a non-readable format so that only an encryption key can convert it back to simple text. Data security solutions typically offer encryption as an important component of their data protection strategy.

Endpoint protection—software that monitors activity on your endpoints, alerting you if someone transfers data in or out of your network.

Data erasure—deleting sensitive data once it has been processed to reduce the risk of exposure. This is an important requirement of regulations like the GDPR.

Disaster Recovery Plan (DRP)—enables you to restore your data after an event that has damaged the data center. Organizations should always have a plan in place so they can recover lost data quickly and easily.

Read On-Prem vs. Public Cloud for Data Protection TCO report.

How To Achieve Data Privacy Compliance

To help your organization fulfill the requirements of data protection regulations like the GDPR, you should build a comprehensive data protection strategy and implement it throughout the organization. Your compliance strategy should include:

Enterprise-wide understanding of obligations—everyone in your organization should know what their responsibilities include. You may also need to comply with additional, local regulations in your country of operation, or affecting your industry. Ensure that every employee knows how to respond to data security events, and is at least familiar with the seven key principles of the GDPR.

Identify risk areas—you should assess the risks involved with any activity that uses personal data. This can help you identify gaps in your existing security policies, so you can update your compliance measures.

Maintain visibility and transparency—use measures such as data mapping to keep track of all personal data that your organization processes. This should include documenting what types of data you collect, where you store it, and why you need to process it.

Appoint a Data Protection Officer (DPO)—this is mandatory for organizations processing personal data for high-risk activities, such as large-scale profiling of sensitive data. The DPO is responsible for monitoring and providing advice on compliance with the GDPR. You can also benefit from a DPO even if not legally required to employ one.

Plan for privacy—the GDPR advocates a “privacy by default and by design” approach, which involves implementing data protection measures throughout the lifecycle of your data processing activities. Organizations must be able to demonstrate that they have an adequate plan in place, or else risk exposing themselves to enforcement action. For this reason, you should incorporate Privacy Impact Assessments (PIAs) into your privacy protection strategy.

Data Protection with Cloudian Storage Devices

Virtually every organization processes sensitive data, which can be commercially valuable and enables the functioning of services like payment applications. However, the use of personal data carries with it a heavy burden of responsibility, especially when you factor in data protection regulations like the GDPR. To help comply with such regulations, you can use secure storage solutions for your data and workloads.

Cloudian provides a low cost disk-based backup target, part of an overall data protection solution. With secure access plus encryption options, Cloudian’s object storage helps protect Personally Identifying Information (PII) while ensuring fast and easy retrieval. It is compatible with AWS to provide a cost-effective, hybrid cloud solution that you can configure to your needs.