<img src="https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/05/NetGovernCaringoWebinar.jpg?resize=300%2C169&ssl=1" alt="Information Governance in the Cloud Age Graphic" width="300" height="169" class="alignright size-medium wp-image-11358" srcset="https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/05/NetGovernCaringoWebinar.jpg?resize=300%2C169&ssl=1 300w, https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/05/NetGovernCaringoWebinar.jpg?w=640&ssl=1 640w" sizes="(max-width: 300px) 100vw, 300px" data-recalc-dims="1" />The value of the cloud and mobile devices is undeniable. The elastic resources provided and the ability to create and access data from any location has changed society. However, as with any disruptive technological movement, it presents new challenges. Privacy concerns run rampant and laws and regulations that have struggled to keep up are now being retrofitted to existing workflows—testing the limits of most information governance and IT execs. Unless you have been avoiding email, you have undoubtedly received a General Data Protection Regulation (GDPR) compliance request of some sort. Why? Because penalty fees for non-compliance can go all the way up to <a href="https://www.csoonline.com/article/3234685/data-protection/how-much-will-non-compliance-with-gdpr-cost-you.html" target="_blank" rel="noopener noreferrer">$20M euros!</a> So, how do you enable information governance in the cloud age?
This is a topic we are going to explore in our upcoming webinar titled <a href="https://www.brighttalk.com/webcast/13173/315203" target="_blank" rel="noopener noreferrer">Enabling Information Governance for Rapidly Scaling Data Sets</a>. Our presentation will focus on solving 3 pain points:
<ol>
<li>Where is the sensitive information?</li>
<li>Who owns it?</li>
<li>How do we protect the organization for its data?</li>
</ol>
In collaboration with our longtime partner and customer NetGovern (formerly Netmail), we will present a high-level framework to help you develop your information governance approach. In addition, we will show how NetGovern integrates Caringo Swarm, leveraging our secure software appliance in a way that is completely transparent to administrators and end users.
Expect this webinar to be a bit different from some of our more technical webinars. Jacques Sauvé, Information Governance Professional (IGP) and Director Partner Enablement at NetGovern, and I will focus on helping any executive new to information governance understand the steps in electronic discovery and the importance of providing a secure archive. We hope you can join us live on <a href="https://www.brighttalk.com/webcast/13173/315203" target="_blank" rel="noopener noreferrer">May 17 at 10 AM Pacific</a> so that you have the chance to ask questions.
<a href="https://www.brighttalk.com/webcast/13173/315203"><img src="https://i1.wp.com/www.caringo.com/wp-content/uploads/2015/09/Register-Now.png?resize=248%2C66&ssl=1" alt="Register Now" width="248" height="66" class="alignnone wp-image-1973 size-full" data-recalc-dims="1"></a>
The webinar will also be available on demand shortly after the broadcast.
<a href="https://www.brighttalk.com/webcast/13173/315203" target="_blank" rel="noopener noreferrer"></a>

Unless you have been avoiding email, you have undoubtedly received a General Data Protection Regulation (GDPR) compliance request of some sort. Why?

Throughout his 30-year career, Tony Barbagallo has leveraged his extensive experience to establish and grow hardware, software and service organizations. He has held a mix of leadership roles at small and large companies, including VP of Marketing and Product Management at Skyera, WildPackets (now Savvius), and EVault, VP of Marketing and Sales at Dantz (acquired by EMC), and senior management positions at Microsoft, Mentor Graphics, Sun, and GE. He holds a BS in Computer Science from Syracuse University and has also completed the Stanford University Executive Program.

Tony Barbagallo

Object-based storage (e.g., Amazon S3-compliant Caringo Swarm Object Storage) is the basis for all Cloud Storage⏤private, public or hybrid).

Cloud Storage

Caringo Swarm Object Storage provides policy-driven data management and tiering to help you comply with General Data Protection Regulation (GDPR). 

GDPR

Object storage (object-based storage) is computer data storage architecture that manages data as objects, as opposed to file storage & block storage.

Object Storage

Information Governance Professional

NetGovern

Information Governance in the Cloud Age

<a href="https://www.caringo.com/webinars/gdpr-secret-object-storage-compliance/gdpr-dirty-secret-webinar-cover" rel="attachment wp-att-10958"><img src="https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/02/gdpr-dirty-secret-webinar-cover.jpg?resize=300%2C169&ssl=1" alt="How Object Storage Enables GDPR Compliance" width="300" height="169" class="alignleft size-medium wp-image-10958" srcset="https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/02/gdpr-dirty-secret-webinar-cover.jpg?resize=300%2C169&ssl=1 300w, https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/02/gdpr-dirty-secret-webinar-cover.jpg?w=445&ssl=1 445w" sizes="(max-width: 300px) 100vw, 300px" data-recalc-dims="1" /></a>The dirty little secret? The General Data Protection Regulation (GDPR) does not just affect companies in the EU, it affects companies around the world that collect or process data concerning EU residents. Caringo Product Manager Glen Olsen and Solutions Architect Alex Oldfield explain the challenges organisations face and how Caringo Swarm Object Storage provides a cost-effective solution to help meet the requirements as well as how Data Protection Officers can use Swarm to monitor and enable GDPR compliance.

Zach Gover

GDPR’s Dirty Little Secret and How Object Storage Enables Compliance

<a href="https://www.caringo.com/blog/information-governance-cloud-age/netgoverncaringowebinar" rel="attachment wp-att-11358"><img src="https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/05/NetGovernCaringoWebinar.jpg?resize=300%2C169&ssl=1" alt="Facilitating Information Governance for Rapidly Scaling Datasets" width="300" height="169" class="alignleft size-medium wp-image-11358" srcset="https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/05/NetGovernCaringoWebinar.jpg?resize=300%2C169&ssl=1 300w, https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/05/NetGovernCaringoWebinar.jpg?w=640&ssl=1 640w" sizes="(max-width: 300px) 100vw, 300px" data-recalc-dims="1" /></a>No organization wants to lose data or waste precious time searching for it when it is needed. And, we all know the costly ramifications of failing to comply with governmental regulations: HIPAA/HITECH, PCI, Freedom of Information Act, GDPR, and many more. Watch this webinar on demand with Jacques Sauvé, IGP of NetGovern, a leader in Information Governance software, and Ben Canter of Caringo, secure scale-out storage, to learn how compliance with current, large rapidly scaling data sets requires tighter integration between information governance and underlying storage infrastructure.

Elasticsearch is a distributed, multitenant-capable full-text search engine with HTTP web interface; it is fully integrated into Swarm Object Storage.

Elasticsearch

Facilitating Information Governance

<img src="https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/05/Netgovern.jpg?resize=300%2C167&ssl=1" alt="" class="alignright wp-image-11378 size-medium" width="300" height="167" data-recalc-dims="1">The author Oscar Wilde once said that “To expect the unexpected shows a thoroughly modern intellect.” And, with today’s explosion of unstructured data (⅓ of which is considered “sensitive”) in enterprise organizations, being prepared for the unexpected just may be the key to survival when it comes to facilitating information governance. Because, no matter how well you’ve architected your organization’s storage, there are times when you must make changes to your current workflow, whether necessitated by business, industry or government regulations. Mastering control of these ever-expanding enterprise data sets is not just an IT issue; it often affects all aspects of an organization.
Last week, I had the pleasure of hosting a webinar with Jacques Sauvé, Information Governance Professional (IGP) and Director Partner Enablement at NetGovern, and Caringo’s Global Sales Director Ben Canter that focused on helping executives new to information governance understand the steps in electronic discovery as well as the importance of providing a secure archive. Some of the statistics presented were mind-boggling to say the least:<img src="https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/05/Netgovern-01.png?w=700&ssl=1" alt="" class="aligncenter size-full wp-image-11406" srcset="https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/05/Netgovern-01.png?w=3678&ssl=1 3678w, https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/05/Netgovern-01.png?resize=300%2C83&ssl=1 300w, https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/05/Netgovern-01.png?resize=768%2C213&ssl=1 768w, https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/05/Netgovern-01.png?resize=1024%2C284&ssl=1 1024w, https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/05/Netgovern-01.png?w=2000&ssl=1 2000w, https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/05/Netgovern-01.png?w=3000&ssl=1 3000w" sizes="(max-width: 1000px) 100vw, 1000px" data-recalc-dims="1" />
We all know the serious implications of failing to comply with governmental regulations: HIPAA/HITECH, PCI, Freedom of Information Act, GDPR, and many more. And, compliance for large, rapidly scaling data sets requires tight integration between information governance and underlying storage infrastructure.
I invite you to <a href="https://www.caringo.com/webinars/facilitating-information-governance/" target="_blank" rel="noopener">watch this webinar</a> on demand to learn more.
<a href="https://www.caringo.com/webinars/facilitating-information-governance/" target="_blank" rel="noopener"><img src="https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/05/facilitating-information-governance.jpg?w=206&ssl=1" alt="Information Governance Webinar Cover" class="" data-recalc-dims="1"></a>
If you have questions, feel free to reach out to the team at NetGovern (<a href="https://www.netmail.com/contact-us" target="_blank" rel="noopener">info@netmail.com</a>) or <a href="/company/contact" target="_blank" rel="noopener">contact our team</a> at Caringo. We have the experts and the solutions to help you.

Compliance for large, rapidly scaling data sets requires tight integration between information governance and underlying storage infrastructure. Learn how NetGovern and Caringo have partnered on solutions to help enable compliance with regulations such as HIPAA/HITECH, PCI, Freedom of Information Act and GDPR.

Sarah Cook is Caringo's Director of Marketing and brings deep expertise in Technical and Marketing Communications and Product Marketing. Sarah has worked for some of the biggest names in technology including Dell and Cisco. Sarah has a B.A. in English Composition with a minor in Music from the University of North Texas.

Sarah Cook

Unstructured data refers to digital files with no pre-defined data model or organizational structure (e.g., video, medical imaging & photos).

Unstructured Data

compliance

Freedom of Information Act

HIPAA

HITECH

Expecting the Unexpected: Facilitating Information Governance

<img src="https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-3.jpg?w=300&ssl=1" alt="GDPR Part 3" class="alignright size-full wp-image-10932" srcset="https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-3.jpg?w=975&ssl=1 975w, https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-3.jpg?resize=150%2C150&ssl=1 150w, https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-3.jpg?resize=300%2C300&ssl=1 300w, https://i0.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-3.jpg?resize=768%2C768&ssl=1 768w" sizes="(max-width: 975px) 100vw, 975px" data-recalc-dims="1" />Two weeks ago, I blogged about the <a href="https://www.caringo.com/blog/eu-gdpr-object-storage/" target="_blank" rel="noopener">challenges of implementing technology to enable General Data Protection Regulation (GDPR) compliance</a>, and last week, I explained <a href="https://www.caringo.com/blog/object-storage-enables-gdpr-compliance/" target="_blank" rel="noopener">how object storage enables compliance</a>. In today’s blog, we will take a look at what should be considered the most important aspect of GDPR, which is of course “data protection,” and how best-of-breed object storage can help secure your data. More specifically, we will examine the features of Caringo Swarm Scale-Out Hybrid Storage that provide Data Protection Officers with the information needed to monitor compliance.
<h3>Data Protection Capabilities of Object Storage</h3>
“Data protection” is a key stipulation of GDPR, specifically protecting personal data from theft and unauthorised access. To achieve this, it is imperative that data access control is incorporated within the storage system. Here the challenge lies with traditional block storage, as data security is generally controlled by the file system. This makes it possible for anyone with the know-how to bypass the filesystem driver and access the data directly at the storage, thus bypassing any filesystem security. Caringo Swarm Object Storage was designed so that you can police all data access requests and require a valid login and password or security token. When this is implemented correctly, the possibility of unauthorised data access can be eliminated. Even in a worst case scenario (e.g., a client system is compromised), without valid storage credentials the intruder would remain isolated from all data stored within the Caringo Swarm ecosystem. Caringo Swarm’s inherent data security combined with advanced architecture protects your data from attacks utilising the likes of <a href="https://www.caringo.com/blog/no-meltdown-swarm/" target="_blank" rel="noopener">Meltdown and Spectre</a> as well as <a href="https://www.caringo.com/blog/object-storage-protects-from-attacks/" target="_blank" rel="noopener">ransomware attacks</a>.
<h3>Data Encryption Brings Peace of Mind</h3>
Data encryption plays an important role in compliance as, over time, physical media such as disks will fail and be replaced. When it does, that failed media becomes a security risk. In the right hands (or worse, in the wrong hands), data can still be recovered from failed media. In fact, there are a number of companies that specialise in just this. Encryption at rest is included as a standard offering with Caringo Swarm. By enabling encryption at rest, you gain peace of mind knowing that even if your old media makes its way into the wrong hands, any data recovered from the media would be encrypted and useless to third parties.
<h3>Monitoring of the Proper Use of Data</h3>
Data Protection Officers overseeing the security of data is only the beginning of GDPR compliance. Data Protection Officers must also make certain that those who have approved access to data are really only accessing what they need to do their job at any point in time. It is well publicised that many of the highest profile data breaches have been inside jobs originating from trusted employees.
How can such inside breaches be avoided? The unfortunate answer is that often they cannot be avoided. Therefore, we must monitor what data is being accessed and by whom, looking for unusual data access patterns. Then, the Data Protection Officer must stop such breaches while they are still in progress and, hopefully, before any data is transferred offsite.
<h3>Monitoring Data Access Activity</h3>
Monitoring unauthorised data access attempts is critical in stopping possible data breaches in their tracks and before they have a chance to take hold. For example, if an unusually high number of failed data attempts are occurring, then its likely that data is being improperly accessed and immediate investigation is warranted so the perpetrator can be stopped. It is for that reason that Swarm Object Storage creates a real-time audit log of all data attempts, no matter if the attempt is successful or not. These logs can be ingested into analytics applications for data access monitoring, both real-time and historical. Such analytics can provide an organisation and Data Protection Officers with a powerful tool to not only monitor GDPR compliance, but also to alert the proper personnel in real-time when compliance is jeopardised.
<a href="https://www.brighttalk.com/webcast/13173/303401" target="_blank" rel="noopener">Register today for our upcoming webinar</a> on February 27, when Alex Oldfield, Solutions Architect, and I will present a webinar on the challenges organisations face and how Caringo Swarm provides a cost-effective solution to meet GDPR requirements and how Data Protection Officers can use Swarm to both monitor and enable compliance.
<a href="https://www.brighttalk.com/webcast/13173/303401" target="_blank" rel="noopener"><img src="https://i2.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-2.jpg?w=200&ssl=1" alt="GDPR Blog" class="alignleft wp-image-10821 size-full" data-recalc-dims="1"></a>February 27, 10:30 a.m. GMT 
GDPR’s Dirty Little Secret & How Object Storage Enables Compliance
<a href="https://www.brighttalk.com/webcast/13173/303401" target="_blank" rel="noopener"><img src="https://i2.wp.com/www.caringo.com/wp-content/uploads/2016/08/Register-Now-04.png?w=175&ssl=1" alt="Register Now" class="alignnone wp-image-6442 size-medium" srcset="https://i2.wp.com/www.caringo.com/wp-content/uploads/2016/08/Register-Now-04.png?resize=300%2C80&ssl=1 300w, https://i2.wp.com/www.caringo.com/wp-content/uploads/2016/08/Register-Now-04.png?w=683&ssl=1 683w" sizes="(max-width: 300px) 100vw, 300px" data-recalc-dims="1" /></a>
In the meantime, if you have any questions, you can always reach us at <a href="mailto:info@caringo.com">info@caringo.com</a>. We will be happy to have one of our object storage experts answer your questions or give you a demo.

Learn about EU GDPR, how object storage can help secure your data, and the features of Caringo Swarm object storage that provide Data Protection Officers with the information needed to monitor compliance.

With over 2 decades of experience, Caringo Product Manager Glen Olsen has a keen focus on architecting data and storage solutions. At Caringo, Glen leads efforts to bridge the gap between traditional storage and our leading-edge scale-out storage solution.

Glen Olsen

With Caringo Swarm Object Storage, you get continuous, built-in data protection along with exceptional resilience, recovery, and content integrity. 

Data Protection

Metadata is "data about data" and can be descriptive, structural, administrative, reference or statistical metadata that is auto- or user-generated.

Metadata

Ransomware⏤malicious software or malware⏤is designed to deny access to systems & data until ransom is paid. Object storage can help protect your data.

Ransomware

Scale-out storage allows for expansion of data capacity through addition of devices that can be plugged in and configured as the need arises. 

Scale-Out Storage

data protection

Meltdown

Spectre

Object Storage for EU GDPR Data Protection

<img src="https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR.jpg?resize=300%2C171&ssl=1" alt="GDPR-Week 2" class="size-medium wp-image-10881 alignright" width="300" height="171" srcset="https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR.jpg?resize=300%2C171&ssl=1 300w, https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR.jpg?resize=768%2C439&ssl=1 768w, https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR.jpg?resize=1024%2C585&ssl=1 1024w, https://i1.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR.jpg?w=1400&ssl=1 1400w" sizes="(max-width: 300px) 100vw, 300px" data-recalc-dims="1" />In last week’s blog, I looked at <a href="https://www.caringo.com/blog/eu-gdpr-object-storage/" target="_blank" rel="noopener">the challenges GDPR presents</a>. In this week’s blog, we will take a look at how Caringo Scale-Out Hybrid Storage provides a simple and cost-effective solution that can enable GDPR compliance.
The first challenge: how do you find all the relevant data when you receive a “Right to access,” a “Data Portability” or a “Right to be forgotten” request from an EU resident? Expecting that anyone can manually login to every application and storage system used by your organization and locate the right data is unrealistic. Not only would this be time-consuming, but it opens the door to the risk of data being missed or data being included that is not within scope.
It would be far more practical to run a single search request against the storage system that then matches all relevant data that is within scope. Of course, depending on the type of request, the scope may change. For example, a “Right to access” request may need to include data that cannot be removed during a “Right to be forgotten” request, and of course a “Right to be forgotten” request cannot include any data that must be retained by law.
<h3>Metadata Radically Simplifies Search</h3>
This is where the power of metadata in Caringo Swarm comes into play. Unlike traditional storage and other object storage solutions, Caringo Swarm object storage allows metadata to be directly attached to the object (data), not stored in a separate database. Swarm also allows this metadata to be modified without having to rewrite the entire file. Most importantly, all of this metadata is indexed and becomes searchable. <a href="https://www.caringo.com/webinars/power-metadata-object-storage/" target="_blank" rel="noopener">Watch this on-demand webinar to learn more.</a>
For example, for all data related to myself, I can attach a piece of metadata such as ‘person-name: Glen Olsen’ and ‘person-DOB: YYYY/MM/DD.’ Now, I can run a query directly against Caringo Swarm requesting a list of all data with matching metadata attached. As long as this metadata has been attached directly to the object, it will be listed regardless of which application or system wrote the object. Additional metadata I can attach might include the application that owns and wrote the data, why we retained that data in the first place, and if that data is eligible for “Right to be forgotten” removal. I now have all the information attached as metadata and searchable to create a list using a simple query against the Swarm storage system, without the need to manually log into any application. Yes, with Caringo Swarm, it can be as simple as that.
<h3>Replication Automates Data Removal</h3>
As we discussed last week, the “Right to be forgotten” can present a whole new set of challenges when this comes to Dev, Test and QA, since often a copy of production data is taken for these environments. How can we ensure that any data removal related to a “Right to be forgotten” request is populated to any copies created of the data? Caringo again offers a simple solution to this problem. Instead of Dev taking a copy of production data, Dev can instead configure replication of data from production so that if the data is removed from production it will also automatically be removed from any replication destination. Moreover, each time a department needs to refresh their copy of data, they can replicate the data from production, ensuring that no data that was removed during a “Right to be forgotten” request reappears in any other environment.
<h3>Continuous Protection without Backups, Significantly Reduces Discovery Time</h3>
Traditional backup will quickly become a thorn in the side of any organisation trying to maintain GDPR compliance, as any “Right to be forgotten” request will require data to be removed not only from Production, Dev, Test/QA and similar systems, but also every copy of that data held in backup. This includes physical media such as tape or other archive. The only easy answer here? <a href="https://www.caringo.com/webinars/stop-wasting-budget-resources-legacy-backup/" target="_blank" rel="noopener">Stop using traditional backup systems</a> and count on the continuous, built-in data protection features of Caringo Swarm. That way, your Chief Security & Risk Officer can breathe easy, knowing that your data is protected and that you have the tools in place to enable compliance with GDPR.
Next week, in the last of this GDPR blog series, we will look at “data protection” and, more specifically, how Caringo Scale-Out Hybrid Storage helps GDPR data protection officers maintain and monitor compliance.
Don’t forget to <a href="https://www.brighttalk.com/webcast/13173/303401" target="_blank" rel="noopener">register for our upcoming webinar</a> on February 27, when my colleague Alex Oldfield, Solutions Architect, and I will present a webinar on the challenges organisations face and how Caringo Swarm provides a cost-effective solution to meet GDPR requirements as well as how Data Protection Officers can use Swarm to monitor and ensure compliance.
<a href="https://www.brighttalk.com/webcast/13173/303401" target="_blank" rel="noopener">Register now to watch</a> live or on demand.
<a href="https://www.brighttalk.com/webcast/13173/303401" target="_blank" rel="noopener"><img src="https://i2.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-2.jpg?w=200&ssl=1" alt="GDPR Blog" class="alignleft wp-image-10821 size-full" data-recalc-dims="1"></a>February 27, 10:30 a.m. GMT 
GDPR’s Dirty Little Secret & How Object Storage Enables Compliance
<a href="https://www.brighttalk.com/webcast/13173/303401" target="_blank" rel="noopener"><img src="https://i2.wp.com/www.caringo.com/wp-content/uploads/2016/08/Register-Now-04.png?w=175&ssl=1" alt="Register Now" class="alignnone wp-image-6442 size-medium" srcset="https://i2.wp.com/www.caringo.com/wp-content/uploads/2016/08/Register-Now-04.png?resize=300%2C80&ssl=1 300w, https://i2.wp.com/www.caringo.com/wp-content/uploads/2016/08/Register-Now-04.png?w=683&ssl=1 683w" sizes="(max-width: 300px) 100vw, 300px" data-recalc-dims="1" /></a>
In the meantime, if you have any questions, feel free to reach out to us at <a href="mailto:info@caringo.com" target="_blank" rel="noopener">info@caringo.com</a>, and we will be happy to have one of our object storage experts get back with you.

In this week’s blog, we will take a look at how Caringo Scale-Out Hybrid Storage provides a simple and cost-effective solution that can enable GDPR compliance.

General Data Protection Regulation

How Object Storage Enables GDPR Compliance

<a href="https://www.brighttalk.com/webcast/13173/303401" target="_blank" rel="noopener"><img src="https://i2.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-1-1.jpg?w=300&ssl=1" alt="GDPR Blog" class="alignright size-full wp-image-10825" srcset="https://i2.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-1-1.jpg?w=1400&ssl=1 1400w, https://i2.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-1-1.jpg?resize=300%2C171&ssl=1 300w, https://i2.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-1-1.jpg?resize=768%2C439&ssl=1 768w, https://i2.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-1-1.jpg?resize=1024%2C585&ssl=1 1024w" sizes="(max-width: 1000px) 100vw, 1000px" data-recalc-dims="1" /></a>If you reside in Europe, you likely already know about the EU General Data Protection Regulation (GDPR), yet, those outside of Europe may only now be gaining awareness of GDPR. Moreover, many are now coming to the realisation that any organisation physically located outside of Europe who has any dealing with European residents will be required to comply.
This is the first important aspect to understand. Every organisation collecting data (Data Collectors) and third party processing data (Data Processors) pertaining to EU residents, is obligated to comply. No matter where that organisation is physically located.
If your organisation is not based within the EU, you may be asking yourself “why would I need to comply?” The answer here is financial, with hefty fines of up to 4% of global annual revenue or 20 Million euros, whichever is greater. Any organisation collecting or acting as a third party by processing European resident personal information is within scope. You will be classified as a collector of personal data simply by allowing an EU resident to sign up to your mailing list.
So what is GDPR, and what does it mean to how an organisation stores and manages data?
To begin, an organisation must, on request, quickly identify all data they control belonging to an EU resident. This is known as an individual’s “right to access.” On request, an organisation must be able provide an electronic copy of the data held, including where it is stored, plus the reason for retaining that data. An individual must also be allowed to submit corrections to any data held. This does not mean the individual requires direct access to the data, only that there must be a means for individuals to submit corrections.
Individuals now also have the right to transmit their data from one controller to another. Upon receipt, an organisation must provide a copy of all the individual’s data held in a “commonly used and machine readable” format. This requirement is known as “data portability.”
An important part of GDPR is an EU residents “right to be forgotten.” Any EU resident can request all personal data retained by an organisation to be removed. This includes any data shared with third parties such as data processors. That regulation persists unless an organisation has a valid reason not to comply; for example, a debt collection agency could not be expected to destroy all personal data related to a debt they are actively pursuing against an individual. Of course, not all personal data is eligible for deletion,  such as if removal of the requested data would breach laws on compulsory data retention.
“Data Protection” is also a key stipulation of GDPR, specifically protecting personal data from being stolen and from unauthorised access. On becoming aware of any data breach that is likely to jeopardise personal data, the data controller must report the breach within 72 hours to the relevant regulator, as well as to every likely affected individual within an acceptable time frame.
Organisations may also be required to employ a “data protection officer” whose role is not only to inform and advise of obligations under GDPR, but to also monitor compliance of GDPR.
An organisation relying on traditional systems, storage, processes and workflows is going to find GDPR compliance both expensive and challenging. It will require a review of all aspects of data storage and protection. For example, legacy data backups could make compliance to the “right to be forgotten” requirement extremely difficult. To comply with a data removal request, not only will the active data need to be removed, but also every instance of that data held on backup media or archive. Similarly, the loss or misplacement of a backup tape is likely to trigger an expensive “data protection” exercise.
The “right to be forgotten” and “data protection” requirements will also force many organisations to change the way they develop and test their applications. Testing using a copy of production data containing personal data could become unmanageable. Not only would such a data-sharing practice put at risk retained personal data, but, in the case of a right to be forgotten request, the organisation will be required to also ensure that data is removed from all development, test and QA environments, and most importantly, not inadvertently restored during test or QA cycles.
Yet, the biggest challenge many organisations will face is simply how to locate in a timely and cost-effective manner all personal information pertaining to an individual, along with why that data is retained in the first place and were it is stored—without forgetting which data is in scope for data removal and what data must be retained.
“Privacy by design” requires that these capabilities, along with compliance to all other GDPR requirements, be built into products and processes from day one.
While this may seem overwhelming, it is important to know that the technology already exists to enable you to comply with GDPR. In next week’s blog, I will look at how Caringo Scale-Out Hybrid Storage provides a simple and cost-effective solution. And, on February 27, my colleague Alex Oldfield, Solutions Architect, and I will present a webinar on the challenges organisations face and how Caringo Swarm provides a cost-effective solution to help you meet GDPR requirements as well as how Data Protection Officers can use Swarm to monitor and ensure compliance.
<a href="https://www.brighttalk.com/webcast/13173/303401" target="_blank" rel="noopener">Register now</a> to watch live or on demand.
<a href="https://www.brighttalk.com/webcast/13173/303401" target="_blank" rel="noopener"><img src="https://i2.wp.com/www.caringo.com/wp-content/uploads/2018/02/GDPR-2.jpg?w=200&ssl=1" alt="GDPR Blog" class="alignleft wp-image-10821 size-full" data-recalc-dims="1"></a>
February 27, 10:30 a.m. GMT 
GDPR’s Dirty Little Secret & How Object Storage Enables Compliance
&nbsp;
<a href="https://www.brighttalk.com/webcast/13173/303401" target="_blank" rel="noopener"><img src="https://i2.wp.com/www.caringo.com/wp-content/uploads/2016/08/Register-Now-04.png?w=175&ssl=1" alt="Register Now" class="alignnone wp-image-6442 size-medium" srcset="https://i2.wp.com/www.caringo.com/wp-content/uploads/2016/08/Register-Now-04.png?resize=300%2C80&ssl=1 300w, https://i2.wp.com/www.caringo.com/wp-content/uploads/2016/08/Register-Now-04.png?w=683&ssl=1 683w" sizes="(max-width: 300px) 100vw, 300px" data-recalc-dims="1" /></a>

What is GDPR, and what does it mean to how an organisation stores and manages data? Can Object Storage help you meet the requirements? Learn more in this blog by Caringo Product Manager Glen Olsen.

The Topic

Related Topics

GDPR Recent Content