This is a talk on enforcing better GDPR compliance, user data privacy, and “security by design” principles through the language and visual components of API documentation. Practical and immediately applicable tips and insights from a Technical Writer working in data security.

1. Disagree with “I Agree”
Karen Sawrey
Technical Writer @ Cossack Labs
cossacklabs.com
Enforcing Better GDPR Compliance
Through API Documentation

2. Hi, I’m Karen!

3. Cossack Labs — British-Ukrainian company

4. Cossack Labs. Convenient cryptographic tools

5. Cossack Labs. Convenient cryptographic tools

6. Cossack Labs Documentation Server

7. CRYPTO is for CRYPTOGRAPHY

8. CRYPTO is for CRYPTOGRAPHY

9. GDPR vs. API docs

10. GDPR vs. API docs
API docs vs. GDPR

11. SECURITY IS

13. SECURITY ISBE
R

14. GDPR

15. GDPR

16. GDPR is

17. GDPR is ?

18. Don’t steal.
Governments hate competition.
— Anonymous

19. ?
QUIZ TIME

20. Nokia Communicator 9000 — made in 1996

21. iPhone — introduced in 2007

22. Timeline of data privacy regulations in the EU
24 October
1995
25 May
2018
Directive [...] on the protection of individuals with regard to the
processing of personal data and on the free movement of such
data
GDPR

23. Timeline of data privacy regulations in the EU
24 October
1995
25 May
2018
Directive [...] on the protection of individuals with regard to the
processing of personal data and on the free movement of such
data
GDPR

24. ▢ I agree

25. A short survey
?
?
?

26. ▢ I agree
BUT DO I?

28. Ain't Nobody Got
Time for That (c)

29. The vicious circle of ignored documentation
Docs
too hard to
read
People don’t
read
the docs
Why bother?
Nobody reads
docs anyway.

31. GDPR
Targets obscurity

32. Human language. Do you speak it?

33. Intend to be concise and informative

34. The docs are not
what they seem

35. Tailoring documentation
and API docs/tutorials for
better GDPR compliance

36. The design for GDPR

37. The design for GDPR

38. The secret life of docs

39. The secret life of docs:
surface

40. The secret life of docs:
beyond the surface

41. Was your credit card hacked?

42. Was your credit card hacked?

43. It’s never “just” an email or a
“disposable” password.

44. Types of data according to GDPR
Personal
data

45. Types of data according to GDPR
Personal
sensitive
data
Personal
data

46. Another short survey
?
?
?

48. Secure
Password
management

49. Secure
Password
management
Rainbow tables
and dictionary
attacks
vs.

50. Great power.
Great responsibility.

51. The great hard answer to life, the universe, and
everything, according to GDPR:
Treat any information of
your users as sensitive

52. Keep it simple

53. If you understand it...

54. …you’ll explain it in simple words.

55. Keep your sandbox user data clean.
Or else.

56. Acra encryption suite. Live web demo

57. Acra encryption suite. Live web demo

58. Security by design.
Show your work.

59. Warning is caring.

60. Informing is caring, too

61. Informing is caring, too

62. A tale of Berlin Airport

63. GDPR is

65. Let’s sum it up

66. GDPR:
werewolf-friendly.

67. With a right “why”,
You’ll find your “how”

68. Welcome!
You're part of the security
team now.

69. Welcome!
You're part of the security
team now.
We all are.

70. Further reading
GDPR FOR ENGINEERS: IMPLEMENTING RIGHTS
AND SECURITY DEMANDS

71. WHAT DO WE REALLY NEED TO ENCRYPT.
CHEATSHEET
Further reading

72. The full text of GDPR
Further reading

73. Thank you

74. Karen Sawrey
karen@cossacklabs,com
@krnswry
www.cossacklabs.com
@CossackLabs
Professor Felix
Is here! Ask me for
a sticker! ;)

75. QUESTIONS?
cossacklabs.com