As the most stringent privacy regulation ever enacted, compliance with the General Data Protection Regulation (GDPR) has enterprise customers assessing their current mechanisms for deletion, PII detection, and customer consent. While on-prem, hybrid, and all-in environments involve different challenges, the AWS cloud offers services and features that are consistent with GDPR considerations, including encryption, pseudonymisation, confidentiality, resilience, and availability. In this webinar we’ll walk customers through potential GDPR obligations as well as the specific tooling and benchmarking that should be considered in the ramp-up to the May 25th, 2018 enforcement date. Also, we will top it up with data regulations in China you should be on the lookout for.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Webinar
Navigating GDPR Compliance on AWS
Iolaire McKinnon – Security, Risk & Compliance
Amazon Web Services

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Sponsor

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What is the GDPR?
What is the GDPR?

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• The "GDPR" is the General Data Protection Regulation, a significant new
EU Data Protection Regulation
• Introduces robust requirements that will raise and harmonize standards for
data protection, security, and compliance across the EU
• The GDPR is enforceable May 25th, 2018 and it replaces the EU Data
Protection Directive (Directive 95/46/EC)
• In scope: Organisations established in the EU and Organisations without an
EU presence who target or monitor EU individuals
What is the GDPR?

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Content vs. Personal Data
Content
= anything that a customer
(or any end user) stores, or
processes using AWS
services, including:
Software ǀ Data ǀ Text ǀ Audio ǀ Video
Personal Data
= information from which a
living individual may be
identified or identifiable
(under EU data protection
law)
• Customer’s “content” might
include “personal data”

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Individuals have the right to a copy of all the personal data
that controllers have regarding him or her. It also must be
provided in a way that facilitates reuse.
What Else Comes With GDPR?

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
This gives individuals the right to have certain personal
data deleted so third parties can no longer trace them.
What Else Comes With GDPR?

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
This helps to facilitate the inclusion of policies, guidelines,
and work instructions related to data protection in the
earliest stages of projects including personal data.
What Else Comes With GDPR?

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Controllers must report personal data breaches to the
relevant supervisory authority within 72 hours. If there is a
high risk to the rights and freedoms of data subjects, they
must also notify the data subjects.
What Else Comes With GDPR?

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
How AWS can help customers
achieve GDPR compliance

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Protection – A Shared Responsibility

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Subjects Customers are
Controllers
AWS as
Processor
Controllers and Processors have
obligations under GDPR
Data Protection – A Shared Responsibility

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Subjects Customer as
Processor
AWS as Processor
Controllers and Processors have
obligations under GDPR
Customer’s customer
as Controller
Data Protection – A Shared Responsibility

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Legal Compliance
(both controllers and processors)
System Security and Data Protection by Design
(both controllers and processors; AWS has tooling to help)
Records of Processing Activities
(both controllers and processors; AWS has tooling to help)
Encryption
(both controllers and processors; AWS has have tooling to help)
Security of Personal Data
(controller responsibility)
Managing Data Subject Consent
(controller responsibility)
Managing Personal Data Deletion
(both controllers and processors; AWS has tooling to help)
Managing Personal Data Portability
(controller responsibility)
GDPR is also a Shared Responsibility

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Under GDPR Controllers and Processors are required to implement appropriate Technical
and Organization Measures (“TOMs”) …
(1) Pseudonymisation and
encryption of personal data
(2) Ensure ongoing confidentiality,
integrity, availability, and resilience
of processing systems and
services
(3) Ability to restore availability and
access to personal data in a timely
manner in the event of a physical
or technical incident
(4) Process for regularly testing,
assessing, and evaluating the
effectiveness of TOMs
GDPR in practice: implementing TOMs

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS services already comply with the GDPR
AWS completed the entirety of our GDPR service
readiness audit on March 26, 2018 - validating that all
generally available services and features adhere to the high
privacy bar and data protection standards required of
data processors by the GDPR.
What does this mean to you?
Customers can deploy AWS services as a key part of their
GDPR compliance plans.

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Tools and Services
Compliance Framework
Partner Network
§§ Data Protection Terms§§
Implementing TOMs - What AWS provides to you

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Implementing TOMs with AWS Services
‘Security of processing’‘Data protection by design and default’
‘Records of processing activities’
AWS Storage
Gateway
Amazon
Virtual Private
Cloud (VPC)
Amazon API
Gateway
AWS
KMS
AWS
CloudHSM
Amazon S3
Server-side
Encryption
AWS Identity
and Access
Management
AWS
CloudFormation
AWS
WAF Amazon
CloudWatch
AWS
CloudTrail
AWS
Config

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The controller “shall implement appropriate technical and
organizational measures for ensuring that, by default, only
personal data which are necessary for each specific purpose of
the processing are processed.”
AWS Identity & Access Management
API-Request Authentication
Temporary Access Tokens
Implementing TOMs with AWS Services - Examples

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Implementing TOMs with AWS Services
Data Access Control

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Implementing TOMs with AWS Services
Data Access Control

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GDPR Compliance Tools
“Each controller and, where applicable, the
controller’s representative, shall maintain a record of
processing activities under its responsibility.”
CloudTrail
Inspector
Macie
AWS Config
Implementing TOMs with AWS Services - Examples

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Implementing TOMs with AWS Services
Monitoring of Access Activities – AWS CloudTrail
AWS CloudTrail

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Implementing TOMs with AWS Services
Monitoring of Access Activities – Amazon GuardDuty
Amazon
GuardDuty

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Organizations must “implement appropriate technical and organizational
measures to ensure a level of security appropriate to the risk, including the
pseudonymisation and encryption of personal data.”
Encryption of data at rest (EBS, S3, Glacier, RDS, etc.)
Centralized Regional Key Management with AWS KMS
IPSec VPN to your AWS environment with Virtual Private Gateway
Dedicated HSM in the cloud with AWS CloudHSM
Implementing TOMs with AWS Services - Examples

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Implementing TOMs with AWS Services
Data Encryption – at rest

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Implementing TOMs with AWS Services
Data Encryption – Key Management of Server-side Encryption

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Appropriate technical and organizational measures may need to include “the
ability to ensure the ongoing confidentiality, integrity, availability, and
resilience of the processing systems and services.”
SOC 1 / SSAE 16 / ISAE 3402 (formerly SAS 70) / SOC 2 / SOC 3
PCI DSS Level 1
ISO 9001 / ISO 27001 / ISO 27017 / ISO 27018
NIST FIPS 140-2
Common Cloud Computing Controls Catalogue (C5)
Implementing TOMs with AWS Services - Examples

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Foundation Services
AWS Global
Infrastructure
Your own
accreditation
Meet your own security objectives
Your own
certifications
Your own
external audits
Customer scope
and effort is
reduced
Better results
through focused
efforts
Built on AWS
consistent
baseline controls
GDPR
Code of
Conduct

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GDPR – Code of Conduct
CISPE Code (Cloud Infrastructure Service Providers in Europe)
The CISPE Code of Conduct :
• An effective, easily accessed framework for complying with the EU’s GDPR
• Excludes the re-use of customer data
• Enables data storage and processing exclusively within the EU
• Identifies cloud infrastructure services suitable for different types of data
processing
• Helps citizens retain control of their personal and sensitive data
• AWS CISPE certified
• CISPE Code of Conduct in evaluation by Article 29 WP

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Marketplace: Your one stop shop for familiar
tools

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Partner Network (APN) & GDPR
Consulting Partners
APN consulting partners can help
your customers get ready for GDPR.
/
Technology Partners
APN technology partners offer
security & identity solutions to help
with GDPR.

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS GDPR Center

34. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Regulations in China

35. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Regulations in China
Data Protection in China is managed under the
“Cyber Security Law of the People’s Republic of China”
• Adopted November 7, 2016
• Came into force on June 1, 2017

36. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Regulations in China: Highlights
Article 40: Network operators shall ensure user
information they collect is kept confidential, and
shall set up and improve a user information
protection system.
Article 41: Network operators are required to
collect and use personal information in a legal and
proper manner.

37. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Regulations in China: Highlights
Article 42: Network operators shall not disclose,
falsify, or damage personal information they collect.
Operators shall not provide such personal
information to others without consent of
information owners, except where processed
information cannot identify specific persons and
cannot be restored.

38. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Regulations in China: Highlights
Article 43: When an individual finds a network operator
collects or uses his personal information in violation of
the provisions of laws and administrative regulations or
the agreement reached between both parties, he has the
right to require the network operator to delete his personal
information; when the personal information collected and
stored by the network operator contains errors, he has
the right to require the network operator to make corrections.

39. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Subjects Customers are
Controllers
AWS as
Processor
Controllers and Processors have
obligations under GDPR
Recap: Data Protection - Shared Responsibility

40. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Tools and Services
Compliance Framework
Partner Network
§§ Data Protection Terms§§
AWS provides assistance for your GDPR journey

41. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Questions? Please type them in.

42. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!

43. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Remember to complete
your evaluations!