Download to read offline
Uploaded byJP Clementi
Azure Privacy & GDPR @ Service Management World
This document summarizes a presentation about Microsoft's approach to complying with the GDPR and lessons learned. It discusses how Microsoft takes privacy seriously and provides tools to help customers comply with regulations like the GDPR. The presentation covers key aspects of the GDPR, how Microsoft cloud services support compliance, and lessons learned around conducting extensive engineering work, continuing to share knowledge, and relying on partners in the compliance journey. Key takeaways are that Microsoft cloud is ready to help customers comply with the GDPR starting May 25, 2018 and that Microsoft is committed to building trust to enable customers' success.
More Related Content
Similar to Azure Privacy & GDPR @ Service Management World
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
Azure Privacy & GDPR @ Service Management World
- 1. Privacy, Trust, andthe GDPR @ Microsoft Approach and Lessons learned JP Clementi, Senior Program Manager Microsoft Azure Engineering | Security, Privacy & GDPR
- 2. Microsoft as atrusted platform GDPR: Our engineering approach and lessons learned Microsoft Cloud: How Azure and Office 365 support GDPR and other compliance requirements Agenda
- 3. “Businesses and usersare going to embrace technology only if they can trust it.” Satya Nadella Chief Executive Officer Microsoft Corporation • We take a principled approach with strong commitments to privacy, security, compliance and transparency. • Moving to the cloud makes it easier for you to become compliant with privacy regulations by managing and protecting personal data in a centralized location. • Microsoft is the industry leader in privacy and security with extensive expertise complying with complex regulations.
- 4. Enhanced personal privacyrights Increased duty for protecting data Mandatory breach reporting Significant penalties for noncompliance General Data Protection Regulation (GDPR) - imposes new rules on organizations in the European Union (EU) and those that offer goods and services to people in the EU, or that collect and analyze data tied to EU residents, no matter where those organizations are located Overview Privacy - Microsoft understands that when you, our customer, use our business cloud services, you are entrusting us with your most valuable asset—your data. You trust that its privacy will be protected and that it will be used only in a way that is consistent with your expectations.
- 5. Right to restriction of processing Securityof processing Notification of a personal data breach to the supervisory authority Transfers subject to appropriate safeguards Penalties Data protection impact assessment Right of access by the data subject Records of processing activities Right to erasure (right to be forgotten) Data protection by design and by default Right of rectification Right to data portability Art. 20 Art. 15 Art. 16 Art. 17 Art. 18 Art. 33 Art. 25 Art. 30 Art. 32 Art. 35 Art. 46 Art. 84 General Data Protection Regulation People Process Technology
- 6. Individuals have theright to: • Access their personal data • Correct errors in their personal data • Erase their personal data • Object to processing of their personal data • Export personal data Organizations are required to: • Protect personal data by implementing appropriate security • Notify authorities of personal data breaches • Obtain appropriate consent for processing data • Keep records detailing data processing Organizations are required to: • Provide clear notice of data collection • Outline processing purposes and use cases • Define data retention and deletion policies Organizations are required to: • Train privacy personnel and employees • Audit and update data policies • Employ a Data Protection Officer (if required) • Create and manage compliant vendor contracts What key changes result from the GDPR? Data Subject Rights Controls and notifications Transparent policies IT and training
- 7.
- 8. Protecting customer privacy withGDPR What does this mean for my data?
- 9. GDPR Overview Consent Management Data SubjectRequest Management Breach Notification Data Inventory, Data Policies, and Data Map Data privacy risk management reporting & portal Data Protection Management Risk & Compliance Management for Data Privacy Engagement Your data sources Your personal data definitions Your policies Your business reasons for data capture Responding to data subject requests and consent changes Breach response Ongoing compliance programs Reporting to authorities
- 10. Microsoft Cloud: TrustedPlatform Transparency & Privacy Operational Security Breach Notification Built-in compliance and security to manage and control access to personal data Data Residency
- 11. Classified as MicrosoftConfidential PRIVACY User Privacy User Privacy enables Active Directory tenant administrators to export user specific data and delete accounts. Learn More Request to export user data Submit and manage user requests to export stored data. Learn More View export requests Track and view requests to export user specific data. Learn More Delete user in Active Directory Delete users from the Azure environment by deleting the user in Active Directory. Learn More Manage User Privacy
- 12. Classified as MicrosoftConfidential PRIVACY
- 13. Classified as MicrosoftConfidential NAME USERNAME TYPE SOURCE 15 items (15 users) Search by name or email Name Deleted users Show Aaish Anand aanand@contoso.com Member Windows Server AD Aaron Robins aaron.robins@contoso.com Member Windows Server AD Abner Lominy abner.lominy@contoso.com Member Azure Active Directory Abramo Russo abramo.russo@contoso.com Member Windows Server AD Adrian Sommaerville asommaerville@contoso.com Member Windows Server AD AR Restore user Forget user User forgotten Successfully removed Aaditya Dakenz from the directory.
- 14. Transparency - ComplianceManager Compliance Manager View your compliance posture against evolving regulations in real-time. Take recommended actions to improve your data protection capabilities. Conduct pre-audits to prepare for external audits.
- 15. Azure covers 79compliance offerings ISO 27001:2013 ISO 27017:2015 ISO 27018:2014 ISO 22301:2012 ISO 9001:2015 ISO 20000-1:2011 SOC 1 Type 2 SOC 2 Type 2 CIS Benchmark CSA STAR Certification CSA STAR Certification CSA STAR Attestation CSA STAR Self-Assessment WCAG 2.0 (ISO 40500:2012) FedRAMP High FedRAMP Moderate EAR DoD DISA SRG Level 5 DoD DISA SRG Level 4 DoD DISA SRG Level 2 DFARS DoE 10 CFR Part 810 NIST SP 800-171 NIST CSF Section 508 VPATs FIPS 140-2 ITAR CJIS IRS 1075 PCI DSS Level 1 GLBA FFIEC Shared Assessments FISC (JP) APRA (AU) OSFI (CA) FCA + PRA (UK) MAS + ABS (SG) 23 NYCRR 500 SEC 17a-4 CFTC 1.31 2FINRA 4511 SOX HIPAA BAA HITRUST 21 CFR Part 11 (GxP) MARS-E NHS IG Toolkit (UK) NEN 7510:2011 (NL) FERPA CDSA MPAA DPP (UK) FACT (UK) Argentina PDPA Australia IRAP Unclassified Australia IRAP Protected Canada Privacy Laws China GB 18030:2005 China DJCP (MLPS) Level 3 China TRUCS / CCCPPF India MeitY Japan CS Mark Gold Japan My Number Act Netherlands BIR 2012 New Zealand Gov CIO Fwk Singapore MTCS Level 3 Spain ENS Spain DPA UK Cyber Essentials Plus UK G-Cloud UK PASF EN 301 549 EU ENISA IAF EU Model Clauses EU – US Privacy Shield GDPR Germany C5 Germany IT-Grundschutz Industry U.S. Government Global Regional
- 16. LESSONS LEARNED • IntensiveEngineering Work Begin early, there’s plenty of engineering work ahead. • Continue Sharing and Learning We will share our experience in complying with complex regulations such as the GDPR. • Partners are key in the compliance journey Together with our partners, we are prepared to help you meet your policy, people, process, and technology goals on your journey to GDPR.
- 17. • Microsoft Cloudis GDPR Ready To simplify your path to compliance, we are GDPR compliance ready across our cloud services beginning on May 25, 2018. • Microsoft Cloud is Built on Trust Satya: “Businesses and users are going to embrace technology only if they can trust it.” - Microsoft cloud is built on trust. • Microsoft Cloud I here to enable you to succeed Microsoft provides tools to help you in your compliance journey KEY TAKEAWAYS
- 18. Resources Azure sales guide,playbook, and customizable presentation for GDPR https://aka.ms/GDPR-Partners GDPR on the Microsoft Trust Center https://microsoft.com/gdpr Compliance Manager https://aka.ms/compliancemanager Azure Blueprints https://aka.ms/Azure-Blueprints
Editor's Notes
- #11 10
- #12 Enabling Data Subject Requests from Azure Privacy Portal
- #15 For example, Office 365 has a tool called Compliance Manager that helps you manage compliance in a central place. It delivers real-time risk assessments on Microsoft cloud services, as well as steps you need to take to become compliant. At-a-glance summary of the shared responsibility model reflecting both Microsoft's and your organization’s data protection and compliance posture for standards and regulations such as ISO 27001:2013, NIST 800-53, the Health Insurance Portability and Accountability Act (HIPAA), the European Union General Data Protection Regulation (GDPR) and others. Each tile in the screenshot represents a control framework, which summarizes a Microsoft cloud service and the regulation you’re measuring your compliance against. Compliance for cloud services is a shared responsibility; there are pieces Microsoft controls and pieces you control. Compliance Manager shows how Microsoft meets its obligations and what actions you need to take to meet compliance standards. You can customize the dashboard to display the Microsoft cloud services and regulations relevant to you. From this dashboard, you can see what Microsoft has to do, and what your organization has to do. You can get all the information you need on Microsoft-managed controls here, including the control implementation details, test plan details, and test results. You can also find step-by-step guidance on how to meet the control requirements for the controls you manage. If you want a quick summary of where you stand, you can look at your Compliance Score for each cloud service you use. To simplify the implementation process, Compliance Manager also offers a control management tool to help you stay on top of all the actions you need to take, allowing you to assign tasks to the right person in your organization. Moreover, you can conduct pre-audits to prepare for external audits, creating audit-ready reports containing evidence you collected when implementing controls.