2022-09-13 kreuzwerker Atlassian - Navigating GDPR and BaFin in the Cloud.pdf

SASCHA WISWEDEL | PRE-SALES SOLUTIONS ENGINEER
Atlassian Enterprise Cloud

Unlock
new ways of working
Practices
People
Tools

Unleash the potential
OUR MISSION
of every team

SOLUTIONS
EXPERIENCE
DATA
INFRASTRUCTURE
EXTENSIBILITY
WORK MANAGEMENT NEW SOLUTIONS
ITSM
AGILE & DEVOPS
COLLABORATION CONNECTION ANALYTICS AUTOMATION ADMIN
COMPLIANCE
THE ATLASSIAN PLATFORM

PROVEN & EXPERIENCED
Jira Software Bitbucket
Jira Align
Opsgenie Statuspage
Confluence Trello
Innovation,
unleashed by Cloud
Jira Work Management
Jira for Business Teams
Jira Product Discovery
Product idea and decision management
BETA
Atlas
Dynamic status reporting
BETA
Halp
Conversational ticketing
Compass
Engineering inventory management
BETA
INNOVATIVE & FUTURISTIC
(“POINT A” PROGRAM)
Atlassian Analytics
Business Intelligence (chartio acquisition)
EAP
Atlassian’s R&D focus: strategic, integrated, extensible

Atlassian Cloud
Today’s topics
Premium Plan Enterprise Plan

TIME TO VALUE
Move fast, accelerate time
to value and
speed to market
ROI
Refocus resources and
investments to maximize
your business ROI
INNOVATION
Future-proof your
strategy & tools with
continuous innovation
REVENUE PROFIT GROWTH
Why Atlassian Cloud?

STORAGE
GUARANTEED
99.9% availability No more file size or limits 24x7 dedicated support
SLA
UNLIMITED PREMIUM
SUPPORT
CLOUD PREMIUM IS BACKED BY

Scale with Premium
JIRA SOFTWARE CONFLUENCE
SCALING TEAMS
Advanced roadmaps
Automation
Capacity planning
Analytics
Team Calendars
Automation
External collaboration
SCALING ADMINS
Automation
Archive projects
Archive pages
Bulk space permissions
Advanced permissions
SCALING
ORGANIZATIONS
IP allowlisting
Sandbox
Release Tracks
COMING SOON
COMING SOON

INTRODUCING…
CLOUD
ENTERPRISE
atlassian.com/enterprise-cloud
Jira Software
CLOUD ENTERPRISE
Confluence
CLOUD ENTERPRISE
Jira Service Management
CLOUD ENTERPRISE

Global Scale
and Reliability
Enterprise-grade
Security &
Compliance
Apps and
Extensibility
Cloud Enterprise Value
Powerful
Governance
Controls

Security features for everyone
SAML Single Sign-on (SSO)
User lifecycle management with SCIM
Organization Audit Logs
Shadow IT insights
Nested groups flattening
Selective user claim
External User Security
COMING SOON
COMING SOON
Encryption at rest & in transit
Data Residency
Mobile Device Management (MDM)
Secure Application Tunneling 🆕
Improved backup and restore
Data Residency for apps COMING SOON
COMING SOON
💡Included with Enterprise

Atlassian Enterprise Plan adds
Governance
Multiple Identity Providers in Atlassian Access
User activity audit log
🆕

Compliance
*
COMING SOON

Security
Bring your own Key
Data Leakage Protection
COMING SOON
FUTURE

Analytics & Data Lake
Atlassian
Data Lake
Atlassian Analytics
Data Warehouse
BI tools
(eg. Tableau and
Power BI)
COMING SOON
COMING SOON

PHONE
SUPPORT
DEDICATED
24/7
SUPPORT
30 MIN IRT
FOR CRITICAL
ISSUES
ENTERPRISE SUPPORT

Cloud scale per site
Maximum number of users (per Cloud site)
0
12000
24000
36000
48000
60000
2018 2019 2020 2021 2022 2023
50.000
35.000
20.000
10.000
5.000
2.000

ORGANIZATIONAL
AUTONOMY
DATA
SEGREGATION
ENVIRONMENT
CUSTOMIZATION
UNLIMITED
SITES

Scale globally with unlimited sites
Cloud Enterprise
Centralized user licensing - pay for user once and grant access to multiple instances
Acquisitions Business Units Security
Corporate Regions
Centralized Admin Console - Manage users, products, security policies, insights and billing
Customize instances with marketplace apps based on team needs

MINIMUM REQUIREMENTS FOR ENTERPRISE
OR
801+ users 201+ agents
501+ users 51+ agents
👀 Financial Services Special

Cloud Trust
Center
Migration
Partners
Cloud loyalty
discount
Cloud migration support
Resources, tools,
offers, and support to
guide your journey
MIGRATION
PROGRAM

Assess
Jour (guided) Journey to cloud
Plan
Launch
Test
Optimize
MIGRATE
Prep

Migration
Assistant App
Helps assessing apps
and migrating core
content from Server to
Cloud
Migration
Manager
Dedicated team
to help you assess and
plan your migration
Solution Partners
Help you with the
hand-on-keyboard
work before, during
and after the migration
Migration Center
Resources, best
practices & migration
tools for every stage of
the migration journey.
Migration Helpers

New: Secure Application Tunnels
Connect Cloud with on-prem without opening your
fi
rewall

User management — centralized

Non-operation
(Business can not work)
Maintenance windows
Outages/Disruptions
Holistic view on Cost Advantages
Risk
Attacks
Data breaches
Security vulnerabilities
Operation
Hardware
Software
Support
Licenses
Maintenance
Covered, maintenance-free and included in Atlassian Cloud

European Union/EEA Germany specific
Cloud Compliance for
Financial Services customers

Audit rights
On-site audits and
flow-down audit
rights over material
sub-outsourcers (i.e.,
AWS)
Cooperation
Commitment to
cooperate with
regulators
Oversight rights
Enhanced
record-keeping
and notifications
in case of a breach
Continuity of
service
In the event of
bankruptcy and after
termination
Included with the Financial Services
Addendum

Eligibility requirements
Cloud Enterprise Plan
> 500 users minimum
No other editions qualify for
this addendum or compliance
Operate in the EU
From regional to
multinational banks with
presence within EEA
Product Scope
Only the above products
apply

Your Cloud Pilot
Navigate GDPR-and BaFin Compliance of the Atlassian Cloud

Shareholder & Co-CEO
Atlassian Expert by Heart
Atlassian Certified Instructor
Atlassian Certified Professional
User since Jira 2.0 EAP & Confluence 1.0
2
Daniel Meisen

Moving to a cloud
future, together…
3
- Guidance on GDPR
- Guidance on BaFin
- Atlassian Cloud compliance
- Guidance on your compliance
Journey to Cloud

5
Guidance on GDPR
© kreuzwerker, 2022 - Navigate GDPR-and BaFin Compliance of the Atlassian Cloud

6
Status Quo
GDPR
?
Disclaimer: The following statements
have been carefully reviewed.
I am not a laywer and this is not legal
advice.
This advice is general in nature and not
to be taken as personal / professional
advice
TL;DR: NAL; TINLA

Starting:
May 25, 2018
When?
Uniﬁed rules
for all EU countries
What?
GDPR Definition
GDPR
European Union
General Data
Protection
Regulation

Protection
Protect personal data
& strengthen privacy
rights of EU individuals
Control
Give users control
over their data
Goals of EU’s General Data Protection Regulation
GOALS

Protection
Control
Give users control
over their data
GOALS
https://time.com/6146178/meta-facebook-eu-withdraw-data/

Protection
Control
Give users control
over their data
GOALS
https://about.fb.com/news/2022/02/meta-is-absolutely-not-threatening-to-leave-europe/

Who is affected by GDPR?
All businesses
collecting or
holding personal
data on EU citizens.
No matter where
they reside!

Name
Address
Phone
Bank / Credit cards
Email address
IP address
Cookies
Online identifiers
…
Personal
Data
Biometric data
Genetic data
Health data
Race, Gender, Religion, …
Sensitive
Data
Types of Personal & Private Data

GDPR Non-Compliance - Penalties & Fines
If your data is breached:
GDPR
FINES
You must
report it within
72
hours
OR
Face a fine up to
20M € or 4%
global turnover

GDPR Non-Compliance - Penalties & Fines
If your data is breached:
GDPR
FINES
You must
report it within
72
hours
OR
Face a fine up to
20M € or 4%
global turnover
https://www.enforcementtracker.com/

Assess GDPR Compliance
Analyze what you collect & where is data stored.
(cookies, tracking pixels, emails, names, addresses…) 1
Check if the time you store personal data is relevant.
If not, remove data. 2
Inform your clients how they can modify or delete their data.
(special mailing, Privacy Policy webpage)
3
Monitor who has access to personal data.
4

Primer on GDPR SaaS assessments
- Assess data flows - is there any data exported outside the EU –
lawfulness, purpose limitation and ensure data minimization.
- Adequacy decisions exist for certain countries (i.e. Switzerland,
Canada, United Kingdom, …) but not for all (USA: Schrems II)
- Decide if a data protections impact assessment (DPIA) is required
required - depends on your specific use case (Art. 35 Abs. 4 DS-
GVO)
- Perform a Transfer Impact Assessment (TIA) – Guidance provided
by Atlassian1
- Ensure up-to date DPA including “new” SCCs – grace period
expires on Dec 27th, 20222
16
1 h"ps://www.atlassian.com/legal/data-transfer-impact-assessment
2 h"ps://www.atlassian.com/legal/data-processing-addendum

17
Guidance on BaFin

BaFin – Guidance on Outsourcing to Cloud Services
- Additional requirements for all non-differentiated outsourcing
according to the KAGB (Scope, Audit-Rights supervised company /
supervised authorities, right to issue instructions, data security /
protection, … - Chapter V)
- Quick Tip: Guidance1 of the BaFin (together with Deutsche
Bundesbank) in cooperation EIOPA, EBA, SSM and other national
supervisory authorities
- Covers outsourcing of materials and items to the Public Cloud (and
private/community/hybrid) as IaaS, PaaS or SaaS.
- Supervised company (you?!) are requested to have a documented
process covering all relevant steps to outsource to a cloud provider.
18
1 https:/
/www.baﬁn.de/SharedDocs/Downloads/EN/Merkblatt/BA/dl_181108_orientierungshilfe_zu_auslagerungen_an_cloud_anbieter_ba_en.html?nn=9866146

BaFin – Guidance on Outsourcing to Cloud Services
- Review your use-case in regards to supervisory law if a case of
outsourcing exists and whether its to be qualified as material -
when in doubt assume outsourcing
- Perform a risk analysis covering all relevant aspects of
outsourcing (type, scope, complexity, risk)
- Review and map all Chapter V (Contractual terms in the case
of (material) outsourcing) requirements to the Atlassian
contractual vehicles1
19
1 https://www.atlassian.com/trust/compliance/resources/bafin/bafin-guidance

20
Atlassian Cloud Compliance

GDPR Compliance: Status Quo
- Updated Standard DPA provided by Atlassian ✔
- Includes „Standard Contract Clauses“ (SCC) ✔
- Data subjects ✔
- Categories of data ✔
- Purpose of processing ✔
- Subprocessors, duties based on Art. 32-36 ✔
21

GDPR Compliance: All well then?
- Data protection by default
- Data residency controls ✔
- Content locked per realm (EU, US, Global)
- Data privacy management
- Incident / response management
22
Additional information available through additional documents

GDPR Compliance: Relevant documents
- Data Processing Addendum
https://www.atlassian.com/de/legal/data-processing-addendum
- Cloud Terms of Service
https://www.atlassian.com/legal/cloud-terms-of-service
- Privacy Policy
https://www.atlassian.com/legal/privacy-policy
- Certification / Compliance
https://www.atlassian.com/trust/compliance
- Atlassian Common Controls Framework
https://www.atlassian.com/trust/compliance/common-controls-framework
- Manage Data Residency
https://support.atlassian.com/security-and-access-policies/docs/understand-data-
residency-and-realms/
- Vendor Security Risks
https://www.atlassian.com/trust/security/vendor-security-risk-response
23

GDPR: Additional Aspects
- Data Residency Controls: What Primary- & Secondary data is
available per region (= “Realm Pinning”)
- Access restrictions: „IP Allowlisting“ vs. VPN
- Varying support for different products (Trello, Jira Align /
OpsGenie / StatusPage)
- Third party apps – You might need indivdual DPAs
- Forge „hosted by Atlassian” – Compliance in line with core
products (Jira / Confluence)
24

Product Content in Realm
https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency-and-realms/ 25

Summary
- Atlassian has invested a lot in its native Cloud and offers a wide
selection of Cloud plans
- GDPR compliance can be assumed based new SCCs / TIA / BCRs –
indivdual assessment is required
- Utilizing additional documentation, guidance (BaFin, TIA) and
certification a GDPR and BaFIN-compliant use is achievable
- Risk-assessment (data protection impact assessment) can be
simplified with Data Residency Controls implemented in Cloud
Standard / Premium / Enterprise and Apps
- Follow the transparency reports:
https://www.atlassian.com/trust/privacy/transparency-report
26

27
Questions?

kreuzwerker GmbH
Ritterstr. 12-14
10969 Berlin
www.kreuzwerker.de
Fon +49 30 609 838 80
Fax +49 30 609 838 899
Thank you !
atlassian@kreuzwerker.de

2022-09-13 kreuzwerker Atlassian - Navigating GDPR and BaFin in the Cloud.pdf

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to 2022-09-13 kreuzwerker Atlassian - Navigating GDPR and BaFin in the Cloud.pdf

Similar to 2022-09-13 kreuzwerker Atlassian - Navigating GDPR and BaFin in the Cloud.pdf (20)

More from kreuzwerker GmbH

More from kreuzwerker GmbH (17)

Recently uploaded

Recently uploaded (20)

2022-09-13 kreuzwerker Atlassian - Navigating GDPR and BaFin in the Cloud.pdf