This document provides an overview of the General Data Protection Regulation (GDPR) for identity architects. It discusses GDPR requirements such as data protection impact assessments, data processing records that must be maintained by controllers and processors, and data subject's rights. It also discusses principles of identity and access management design and best practices related to GDPR compliance. Finally, it includes links to Facebook and Google's cookie and data use policies.

1. Senior Director - Security Architecture, WSO2
General Data Protection Regulation
(GDPR) for Identity Architects
Prabath Siriwardena

2. GDPR OVERVIEW

14. 14

15. 15
DATA PROTECTION IMPACT ASSESSMENT (DPIA)
● Following activities are required to have a DPIA
○ Processing of special categories of personal data at large scale.
○ Core business activities consist of systematic monitoring of the data subject at
large scale.
○ Monitoring of publicly accessible areas at a large scale

16. 16

17. 17

18. 18

19. 19
DATA PROCESSING RECORD (CONTROLLER)
● Name and contact details of controllers, the representatives, and data protection
officer.
● Purposes of processing
● Description of the categories of data subjects and categories of personal data.
● The categories of recipients to whom the personal data have need or will be
disclosed.
● Transfers of personal data to a third country/international organization.
● Time limits for the erasure of the different data categories.
● General description of the technical and organizational security measures.

20. 20

21. 21
DATA PROCESSING RECORD (PROCESSOR)
● Name and contact details of controllers, the representatives, and data protection
officer.
● Categories of processing
● Transfers of personal data to a third country/international organization.
● General description of the technical and organizational security measures.

22. 22

23. 23

24. 24

25. 25

26. 26

27. 27

28. 28

29. 29

30. DATA SUBJECT’S RIGHTS

31. 31

32. 32

33. 33

34. 34

35. 35

36. 36

37. 37

38. IAM DESIGN PRINCIPLES
AND
BEST PRACTICES

39. 39

40. 40

41. 41

42. 42
FACEBOOK COOKIE POLICY
https://www.facebook.com/policies/cookies/

43. 43
GOOGLE COOKIE POLICY
https://www.google.com/policies/technologies/cookies/

44. 44

45. 45
FACEBOOK DATA USE POLICY
https://www.facebook.com/full_data_use_policy

46. 46

47. 47

48. 48

49. 49

50. 50

51. 51

52. wso2.com
52