GDPR (General Data Protection Regulation) Compliance Requirements

What are the encryption technologies used by the provider?

While the GDPR does not explicitly talk about encryption methods, the way encryption keys are stored is important to decide whether the re-identification of persons from the leaked encrypted dataset is possible with reasonable efforts. With in-transit & at-rest encryption, the cloud provider has access to the encryption keys, while with end-to-end encryption, the keys are stored at the user only (the provider never has access to plaintext encryption keys). Because of this, in case of a data breach, re-identification of persons from the end-to-end encrypted data is infeasible. This way, end-to-end encryption with client-side key management represents stronger protection for personal data.

What further security and control features does the provider offer?

Beyond strong encryption, the provider needs to take further steps to secure the data of their users. First and foremost, account security should be taken seriously. This includes managing user authentication securely, preferably with zero-knowledge methods. There are different levels of how securely a service provider treats your password. The highest level of password protection is the “zero-knowledge” method: your provider has zero-knowledge about your password. In this case, your password won’t be compromised if the service provider is hacked nor in the case of an employee leak.

According to surveys, a large part of data breaches is caused by employee errors or malicious employees. These incidents can include cases when work devices are lost or stolen, or when employees leak data on purpose. Make sure that your provider offers extensive data control and governance features to minimize the risks of these events. There are several useful features you should look for: permission management to set up granular access levels to personal and other sensitive data, the option to monitor staff’s activities related to files management such as who opened or deleted the files (audit trail), the possibility to create and monitor internal security policies related to data security, backup options like deleted file recovery, and device control tools. (access revoke, remote wipe, etc.).

Is the provider transparent about data residency and data protection?

The GDPR states that personal data should be processed lawfully, fairly, and in a transparent manner. This applies both to businesses managing personal data (data controllers) and cloud-based services they use (data processors). The data controller though has to make sure that the third-party services they use to meet these requirements, as according to the principle of accountability, the final responsibility and liability of protecting the data lies on them. The controller should be able to demonstrate compliance with all the principles relating to the processing of personal data.

Data residency is an essential aspect, too. Although the GDPR doesn’t specify whether the data should be stored in the EU, ensuring GDPR compliance is more straightforward if your provider stores your data in EU datacenters. When the provider uses third-country data-centers or sub-processors, additional guarantees are needed to ensure that your data is protected according to the same high standards as the EU prescribes with the GDPR.

Does the company provide binding documents on data protection?

To provide EU residents with stronger control over the privacy of their data, the GDPR unifies data protection regulations across all member states. This means that all companies who manage the personal data of EU residents have to adhere to its strict requirements.

In case you’re looking at an EU-based cloud solution provider, always look for proof that the company has already started to prepare their data management processes for the GDPR. This includes, among many other things, providing the required documents on data protection such as a clear and easy-to-understand Privacy Policy and Terms of Use, and beyond that, a Data Processing Agreement that they can sign with their business customers. If the cloud company is not located in the EU, you have to look for other proof beyond that. Make sure that the company:

• is established in a country that received a data protection adequacy decision from the European Commission (for example, Tresorit is located in Switzerland, a country with adequacy status from the European Commission). or
• is certified under the EU-US Privacy Shield, or
• provides other adequate contractual guarantees that prove they have the same high level of protection as EU companies (for example, Standard Contractual Clauses adopted by the European Commission, or Binding Corporate Rules (BCRs) approved by the procedure detailed in GDPR Article 47

How does the company prove that the above practices are enforced?

The GDPR is revolutionary because it applies a risk-based and by-design approach to data protection. Companies have to assess risks related to the management of personal data and implement appropriate technical and organizational measures to minimize them. Beyond this, they have to able to prove that they took the necessary steps that are appropriate to the risks.

This applies to any cloud provider that you consider using, too. Although the GDPR is a new regulation, there are further data protection guarantees you can look for. Look for other information security certifications or compliance standards like ISO, HIPAA. Check if third-party information security audits were performed.