Europe’s General Data Protection Regulations (GDPR) will go into effect in less than a year (on 25 May 2018). Achieving data compliance is far from simple and businesses must continuously review how they gather, process and protect personal data. From how data is stored and used to how you secure and even erase information from corporate systems, discover how graph technology can address key challenges relating to Data Quality, Governance and Metadata Management.

1. GDPR: Leverage the power of
Graphs
Neo4j - The Graph Database

2. Agenda
— Neo4j
— GDPR & its implications for data management
— How can a Graph Database help with GDPR
compliance?
— Trust-Hub
— A ‘privacy-by-design’ platform supporting the flow of
personal data across organisational ecosystems, based
on Neo4j
— Next Steps
Anthony Flynn
Sales Director UK & Ireland, Neo4j
Dr Jesús Barrasa
Sr Graph Solutions Consulting, Neo4j
Will Parton
Chief Technical Architect. Trust-Hub

3. Neo4j – Exploit the Business Value in Data Relationships
Data is increasing in volume…
• New digital processes
• More online transactions
• New social networks
• More devices
Using Data Relationships unlocks value and
new business capability
• Real-time recommendations
• Fraud detection
• Master data management
• Network and IT operations
• Identity and access management
• Graph-based search
… and is getting more connected
Customers, products, processes,
devices interact and relate to each
other

4. Unlocking Value from Your Data Relationships
• Model your data as a graph of data
and relationships
• Use relationship information in real-
time to transform your business
• Add new relationships on the fly to
adapt to your changing business

5. Graphs Everywhere
“Neo4j saved well over two years
of work and one million dollars
of taxpayer funds.”

6. General Data Protection Regulation Regulation (EU) "
2016/679
• In effect from May 25 2018
• Introduces new rights for individuals:
• The ‘right to be forgotten’
• The right to control how and where personal data is used
• The right to know when privacy is breached
• The right to correct errors in personal data
• Introduces new responsibilities for organisations collecting
personal data:
• Ability to enforce the individual’s rights above
• Requirement to ensure that personal assent is properly
obtained and granted
• Adequate security and privacy of data
• Notification of the authorities when privacy is breached
• Requirement to enforce compliance on third parties

7. GDPR will impact every business
— Fines for breach of the regulations amount to 4% of global turnover(revenue) or €20M for each instance of
breach
— Organisations will have 72 hours to notify authorities and customers of serious breaches of data security
— Larger organisations will be required to appoint a Data Protection Officer (DPO)
— Active discussion of adding personal liability for the officers of the company
— Among the proposals for the U.K.’s new Digital Economy Bill (the Bill), due to become law next spring, was one
under which company directors would become personally liable for payment of fines as a result of nuisance calls
being made by their companies
— Businesses utilizing personal data for business purposes cannot assign responsibility to their cloud or
security service providers that are processing or storing personal data on their behalf

8. Implications of GDPR for Data Governance
• Organisations must be able to find every reference to an
individual regardless of where and how it is stored, and
completely remove all such instances if requested to
• Personal information relating to customers and other
stakeholders must be consistent across all systems
• Therefore compliance will depend on effective :
• Identification of related data across diverse data
sources.
• Data lineage capability to understand the flow of
data within organisational IT and to know where to
find it
• Effective Customer 360º View to manage all related
information

9. Protect Your Enterprise
Questions to ask concerning data management practices, policies, processes (systems) and awareness
What data do you
have?
• Data Asset Inventory
Why do you have
this data?
• Trace data to its usage,
cleanse the data
Where is this
data?
• Which system(s),
physical location of
data, data movement
How did you get
this data?
• Traceability and
irrefutable proof of data
source
When did you get
this data?
• Timestamped data
acquisition, access,
transfer
Who has access
to this data?
• People (training),
processes & systems
Is the data
Secure?
• Robust data
management lifecycle
and security practices
Do you maintain
a map of this
data?
• Is all of this meta-data available
in a connected fashion

10. Practical Steps towards GDPR compliance
— Implement a data governance platform
— Data definition via business glossary mapped to implementation detail
— Tracking create / update / access / deletes of data
— Tying relevant processes that operate on regulated data
— Building reverse lineage capability to map the data flow
— Update data lifecycle management process and policies
— Implement a visual dashboard of KPIs for DPOs
— Provide a portal and programmatic interface for individuals
— access/update their data, provide/revoke consent, transfer data & view rights
— Create a regulatory governance steering group lead by a DPO

11. Data Governance and Graphs
• Neo4j seeing rapid adoption to help with data
governance in finance, government, retail, healthcare
and communications
• Neo4j has an innate ability to store and query
relationships as well as simply the data itself
• Dramatically easier to model complex personal
data and its access controls
• Highly tolerant of data diversity and evolving data
schema
• Graph databases can look for and react to patterns
in the data as they occur
• Manage data flow and respond to problems and
threats in real-time
Master Data
Customers
Suppliers
Products
Employees

12. Leverage the power of Graphs
Neo4j and GDPR
25 July 2017
GraphTalks
Dr. Jesús Barrasa - Senior Graph Solutions Consultant - @BarrasaDV

13. AGENDA
• What is a Graph Database?
• Key Use Cases
• Graphs for GDPR
• Demo
• Takeaways

14. WHAT IS A GRAPH?

15. A way of representing data
DATA DATA

16. Relational
Database
Good for:
Well-understood data structures
that don’t change too frequently
A way of representing data
Known problems involving discrete
parts of the data, or minimal
connectivity

17. Graph
Database
Relational
Database
Good for:
Well-understood data structures
that don’t change too frequently
Known problems involving discrete
parts of the data, or minimal
connectivity
A way of representing data
Good for:
Dynamic systems: where the data
topology is difficult to predict
Dynamic requirements:
the evolve with the business
Problems where the relationships in
data contribute meaning & value

18. THE PROPERTY GRAPH
DATA MODEL

19. A Graph Is

20. ROAD
Incident
LIGHT
A Graph Is
LIGHT

21. HAS
AVAILABLE
HOTEL
ROOMS
AVAILABILITY
A Graph Is

22. KNOWS
KNOWS
KNOWS
WORKS_AT
WORKS_AT
WORKS_AT
COMPANY
STANFORD
STUDIED_AT
KNOWS
NEO
COLUMBIA
STUDIED_AT
STU
D
IED
_AT
STUDIED_AT
NAME:ANNE
A Graph
SINCE:2012
RELATIONSHIPS
NODE
PROPERTY

23. A Graph
NAME:ANNE
SINCE:2012

25. GRAPH THINKING

26. Look at this data…

27. … now look at it again, this time as a graph

28. Use of Graphs has created some of the most successful companies in the world
C
34,3%B
38,4%A
3,3%
D
3,8%
1,8%
1,8%
1,8%
1,8%
1,8%
E
8,1%
F
3,9%

29. Neo4j is the world’s first “off the shelf” graph database
designed to derive value from data relationships

30. Finance HR &
Recruiting
Manufacturing
& Logistics
Health CareTelco Retail
Today we see graph-projects in virtually every industry
Government

31. NEO4j USE CASES
Real Time Recommendations
Fraud Detection
Identity & Access Mgmnt
Network & IT-Operations
Master Data Management

32. VALUE FROM GRAPHS
IN SUPPORT OF GDPR COMPLIANCE

33. Data Modelling and Definition
1
Data Lineage2
Consent Management 3
Entitlement 4
GRAPHS IN
SUPPORT OF
GDPR
COMPLIANCE

34. #1 Data Modelling and
Definition

35. Party
CUST_SCHEMA
Party
First NameHAS_LOGICAL_ATT
CUST_SCH
EMA.ROLE
CUST_SCHEM
A_PARTY.FIRST_
NM
CUST_SCH
EMA.PARTY
SHEMA_HAS_TABLE
#1 Data Modelling and Definition
Party
Last Name
HAS_LOGICAL_ATT
SHEMA_HAS_TABLE
GENERATES
CONCEPT_FOR
CONCEPT_FOR
CONCEPT_FOR
HAS_NAME
CUSTOMER
NAMECUSTOMER
HAS_PHONE
TABLE_HAS_COL
CUST_SCHEM
A_PARTY.LAST_
NM
TABLE_HAS_COL
GENERATES
Enterprise Ontology
Application Logical
Model
Physical Schema

36. bu
m
#2 Data Lineage

37. ETL_PROC
_1
SALES_SCHEMA
Normaliz
e_Date
SLS_SCHEM
A.PRODUCT
SLS_SCHEMA.S
ALES.DATE
SLS_SCHE
MA.SALES
SHEMA_HAS_TABLE
#2 Data Lineage
Channel_No
rmalization
SHEMA_HAS_TABLE
HAS_COL
SLS_SCHEMA.S
ALES.CHANNELHAS_COL
BusinessView
Integration MiddlewareOperational Systems
HAS_INPUT
HAS_INPUT
Time.time_key
Time.day_of_
week
Enterprise DWH
HAS_OUTPUT
HAS_OUTPUT
HAS_COL
HAS_COL
TechnicalView
Billing
System
EDWH
CDE:
Transaction
_Date
SENDS RECEIVES
CONCEPTUAL_ELEMENT_FOR
Star_Schema
Star_Sch
ema.Time

38. #3 Consent management

39. #3 Consent Management + MDM
2 Blackfriars
Bridge rd.
J.Barrasa
+44776611…
jesus@neo4j
.com
PHO
NE_FO
R
EMAIL_FOR
ADDRESS_FOR
jb@outlook.
com
EMAIL_FOR
{ contrib: ‘XYZ’,
permittedFor: [UC1,UC4],
consentUntil : 31-12-19 }
{ contrib: ‘internal’,
permittedFor: [UC3],
consentUntil : 31-12-20 }
{ contrib: ‘internal’,
permittedFor: [UC3],
consentUntil : 31-12-20 }
{ contrib: ‘internal’,
permittedFor: [UC3],
consentUntil : 31-12-20 }
EMAIL_FOR
{ contrib: ‘LMN’,
permittedFor: [UC2,UC6],
consentUntil : 31-12-20 }

40. #4 Entitlement

41. #4 Entitlement
User 1 User 3User 2
Exclusion
List G1
Resource 1
Group 1
Resource 2
Group 3
D
MEMBER
CRUD
MEMBER
R
M
EM
BER
MEMBER
CRUD

44. DEMO

45. TAKEAWAYS

46. • Flexibility and expressivity of graph model enables agile
approach
• DB enables structured querying and machine readable
export to comply with “right to data portability”
• Added benefits: Risk assessment, customer 360 and
governance + metadata management.

47. Privacy in Plain Sight
25/07/2017 ©trust-hub Ltd Public 1

48. • trust-hub Overview
• GDPR
• Key Themes
• Unexpected impact
• Starting the GDPR journey
• Our use of graph databases
• Privacy Lens Demonstration
• Q&A
25/07/2017 ©trust-hub Ltd Public 2
Agenda

49. 25/07/2017 ©trust-hub Ltd Business Confidential 3
PRIVACY
LENS
PRIVACY
HUB
DISCOVER &
MAP
OPTIMISE
COMPLYMANAGE
trust-hub Ltd
Data Privacy Lifecycle Management Platform
trust-hub delivers an privacy-by-design platform supporting the flow of
personal data across organisational ecosystems within a safe, compliant and
scalable framework. Our solution
dynamically maps data through
trust-hub Privacy (Business) Lens
providing real-time decision-making
dashboards on the context, location,
rights and sensitivity of personal
data.

50. • Turn back the clock for an individual’s control of their personal data
• Privacy by Design
25/07/2017 ©trust-hub Ltd Public 4
What is GDPR trying to achieve?

51. • Massive change to the cost model for holding Personal Data.
• Data privacy needs to be understood across and beyond an
organisation.
25/07/2017 ©trust-hub Ltd Public 5
Side-effects of GDPR

52. • Know Your Data
• Personal Data & The 4Ps
25/07/2017 ©trust-hub Ltd Public 6
Achieving GDPR compliance. Where do I start?
Personal Data Processes
Platforms People
Places
Owned by /
Used By
Located at
Residing on
Responsible for
Uses
Generates

53. • Where/what is the data and who/what interacts with it?
• Understand at a high level and iterate to add detail where required.
• Assess against GDPR to identify weaknesses or non-compliance.
25/07/2017 ©trust-hub Ltd Public 7
The Privacy Lens Process
DISCOVER OPTIMISE COMPLY MANAGE
PRIVACY
LENS
DISCOVER
&
MAP
OPTIMISE
COMPLYMANAGE
• KYD • Knowledge base
• Risk Analysis
• Compliance
• Processes
• Data
• Breach Management
• Risk management

54. PRIVACY LENS PRIVACY
HUB
DISCOVER
&
MAP
OPTIMISE
COMPLYMANAGE
• Privacy Lens : modelling, visualisation and analysis of an organisation’s
privacy data.
• Graph visualisation using Cambridge-Intelligence’s KeyLines toolkit.
• Protect&Store : secure storage of Personal Data
25/07/2017 ©trust-hub Ltd Public 8
Graphs at the heart of two of trust-hub’s modules.

55. 25/07/2017 ©trust-hub Ltd Public 9
Privacy Lens
Demonstration

56. -
25/07/2017 ©trust-hub Ltd Public 10

57. Next Steps
— GDPR Guidance on the EC website @
http://www.eugdpr.org/
— Register for a GDPR brown-bag graph talk with your
team: https://neo4j.com/brownbag/
— Spend 1 hr. to discuss your GDPR initiative with us and
validate your solution / approach. Email us at
uk@neotechnology.com
— trust-hub Privacy Lens : hello@trusthub.com
Thanks! anthony.flynn@neo4j.com, www.neo4j.com