GDPR and technology - details matter Kalle Varisvirta @kvirta
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
GDPR and technology - details matterKalle Varisvirta @kvirta
Me
Kalle Varisvirta
Technology Director
Not a lawyer
Documentation vs.
reality
Documentation vs. reality
Privacy policies (as well as PIAs) are usually written by interviewing Developers and Systems Engineers, but unfortunately by non-technical people
Technical people simplify things when asked about details by non-technical people - that’s what we’re told to do
Cloud & SaaS services
Residual data &
removing data
Residual data &removing data
Data leaves a trace when going through a system
Mapping your data exactly is very difficult, as is removing it
Varnish or CDN in the front
Web server logs
Local caches
Uploaded binary files
Backups of the servers
MySQL logs
Binary logs on all servers
Backups of binary logs
Database dumps made by developers
Production dumps to staging environment
Integration platform logs and local caches
Integration platform document DB oplogs
SaaS messaging platform logs and internal database
All the SaaS services
Finally the actual data master, its logs, backups and development environment
Residual data
Data flows are complicated
Residual data is easily overlooked and forgotten
Removal of data becomes very problematic in the real world
Removing from backups
Electronic format & data aggregation
Electronic format
There are a lot of requirements for providing data in an electronic format
Most systems have the data spread out optimized for the system, not aggregation
Gathering data to a “single” electronic format would be a complicated and slow manual task for most environments
What to do?
What to do?
Take the regulation seriously
Map out your systems, in full detail
Consider data flow through the system
Consider the cloud / SaaS services you might be using
Consider residual data
What to do?
For compliance, make sure technical personnel (either internal or from your vendors) are involved
To understand the regulation, not just to provide answers
Thanks. Questions?
Related Documents
![[GDPR Webinar Slides] Path to GDPR Compliance](https://static.cupdf.com/doc/110x72/586fe3d11a28ab18428b80f7/gdpr-webinar-slides-path-to-gdpr-compliance.jpg)
