1.
GDPR:
BATTENTHE HATCHES ITS
COMING!
Kyle Davies – Solutions Architect
VMWORLD EU 2017 -VMTN6642E

2.
WHO AM I?
• Kyle Davies
• CDW - Solutions Architect
• Twitter: @kdavies1988
• Blog: www.kyle-davies.com
• Experience: 10Years+
• Accreds: vExpert 2016-2017, Citrix CTA, FormerAtlantis
ACE, Cisco Spark Ambassador…

3.
VMWARE DISCLAIMER
• This presentation may contain product features or functionality that are currently under
development
• This overview of new technology represents no commitment fromVMware to deliver these
features in any generally available product
• Features are subject to change, and must not be included in contracts, purchase orders, or
sales agreements of any kind
• Technical feasibility and market demand will affect final delivery
• Pricing and packaging for any new features/functionality/technology discussed or presented,
have not been determined
• This information is confidential

4.
MY DISCLAIMER
• I am not a lawyer
• Technology is an enabler / helping hand for GDPR and not the answer
• Thoughts are my own, and not necessarily the thoughts of CDW
• The session is to get you thinking about GDPR if you haven't already

5.
AREAS COVERED IN 30 MINUTES
• Timeframes
• Directive vs regulation
• Definitions
• Why the need for GDPR
• The high level differences between
DPD & GDPR
• Key GDPR features / impact points
• GDPR myths
• Fines
• The structure
• The ICO advised approach
• My advised approach
• WhereVMware can help
• Closing statement

6.
QUESTION
HANDS UP….
WHO IS CURRENTLY DOING SOMETHING FOR
THE GDPR?

7.
QUESTION
HANDS UP….
WHO HAS NO IDEA ABOUTTHE GDPR OR
HASN’T EVEN LOOKED AT ITYET?

8.
QUESTION
HANDS UP….
WHOTHINKSTHE GDPR DOESN’T APPLYTO
THEM?

9.
TIMEFRAMES
• 8 april 2016 - european council adopted the regulation
• 14 april 2016 - regulation was adopted by the european parliament
• 4 may 2016 - published in the EU official journal in all the official languages
• 24 may 2016 - the regulation entered into force
• 25 may 2018 – applies from this date
This regulation shall be binding in its entirety and directly applicable in all
member states

10.
DIRECTIVE vs REGULATION
DIRECTIVE
Instrument passed at EU level
National implementation
Local variations
REGULATION
Instrument passed at EU level
No need for national implementation
One ring to rule them all

11.
SOME DEFINITIONS
Definition Definition Description
Personal Data
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an
identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to
an identifier such as a name, an identification number, location data, an online identifier or to one or more
factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural
person;
Processing
‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal
data, whether or not by automated means, such as collection, recording, organisation,
structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Profiling
‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to
evaluate certain personal aspects relating to a natural person, in particular to analyse or predict
aspects concerning that natural person’s performance at work, economic situation,
health, personal preferences, interests, reliability, behaviour, location or movements;

12.
SOME DEFINITIONS
Definition Definition Description
Pseudonymisation
‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no
longer be attributed to a specific data subject without the use of
additional information, provided that such additional information is kept separately and is subject
to technical and organisational measures to ensure that the personal data are not attributed to an identified
or identifiable natural person;
Controller
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly
with others, determines the purposes and means of the processing of
personal data; where the purposes and means of such processing are determined by Union or Member
State law, the controller or the specific criteria for its nomination may be provided for by Union or Member
State law
Processor
‘processor’ means a natural or legal person, public authority, agency or other body which processes
personal data on behalf of the controller

13.
SOME DEFINITIONS
Definition Definition Description
Consent
‘consent’ of the data subject means any freely given, specific, informed and
unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear
affirmative action, signifies agreement to the processing of personal data relating to him or her;
Personal Data
Breach
‘personal data breach’ means a breach of security leading to the accidental or unlawful
destruction, loss, alteration, unauthorised disclosure of, or access to,
personal data transmitted, stored or otherwise processed
Enterprise
‘enterprise’ means a natural or legal person engaged in an economic activity, irrespective of its legal form,
including partnerships or associations regularly engaged in an economic activity;
Supervisory
Authority
‘supervisory authority’ means an independent public authority which is established by a Member State pursuant
to Article 51;
International
Organisation
‘international organisation’ means an organisation and its subordinate bodies governed by public international
law, or any other body which is set up by, or on the basis of, an agreement between two or more
countries.

14.
WHYTHE NEED FOR GDPR &THE CHANGE?
2003
2004
2006
EU DPD – 1995
UK released DPA - 1998
1998
1998
1995
1995
1998
1996 2016

15.
WHYTHE NEED FOR GDPR &THE CHANGE?
Percentage of households with home computers in the United Kingdom
https://www.statista.com/statistics/289191/household-penetration-of-home-computers-in-the-uk/
2015/2016 – 88%
1996/1997 – 27% 2001/2002 – 49%1990 – 17%
2007/2008 – 72%

16.
WHYTHE NEED FOR GDPR &THE CHANGE?
Percentage of households with home computers in the United Kingdom
https://www.statista.com/statistics/289191/household-penetration-of-home-computers-in-the-uk/
2015/2016 – 88%
1996/1997 – 27% 2001/2002 – 49%1990 – 17%
2007/2008 – 72%
1998/1999 – 9%
Percentage of households with internet connection in the United Kingdom
2001/2002 – 39%
2008 – 66% 2014 – 84%
https://www.statista.com/statistics/289201/household-internet-connection-in-the-uk/

17.
HIGH LEVEL CHANGES FROM DPDTO GDPR
DPD GDPR
34 Articles 99 Articles
72 Recitals 173 Recitals
No Detail on provisions of consent Details valid conditions for consent
No detail on children data processing
Details an age limit for making processing lawful against
children
Right to be forgotten only in limited circumstances
(unlawful processing or incomplete/inaccurate) Lists conditions under which the right can be exercised
No obligations for maintaining records of processing
activities
Lists out obligations of controllers and processors to be
able to demonstrate and become accountable for
processing
No enforcement of accountability
Enforcement of accountability and conditions for
imposing fines
https://cis-india.org/internet-governance/blog/comparison-of-general-data-protection-regulation-and-data-protection-directive

18.
HIGH LEVEL CHANGES FROM DPDTO GDPR
GDPR
Regulation not a Directive
Personal Data Redefined (including online unique identifiers)
Mandatory Breach Notification
Financial Repercussions / Penalties
One Stop Shop (kind of)
Information Governance:
Track how and where data is used, captured etc
Transparency:
Controller must provide clear information on data subjects rights
Explain how data will be processed
Any communication must be clear, plain language that will be understood by target audience
Data Portability:
Structured and machine readable
Controller to Controller transmission upon request of data subject
Right to be forgotten (if no legitimate ground for retain)
Data Processors liable to same level as Data Controllers
Global Impact for Multi National Businesses that Deal in the EU

19.
GDPR MYTHS
BIGGESTTHREAT IS EYE WATERING FINES
"Issuing fines has always been, and will continue to be, a last resort. Last
year (2016/2017) we concluded 17,300 cases. I can tell you that 16 of them
resulted in fines for the organisations concerned.“
"While fines may be the sledgehammer in our toolbox, we have access to
lots of other tools that are well suited to the task at hand and just as
effective"
Elizabeth Denham, ICO
https://iconewsblog.org.uk/2017/08/09/gdpr-sorting-the-fact-from-the-fiction/

20.
GDPR MYTHS
EVERY ORGANISATION NEEDS A DATA PROTECTION OFFICER!
DPOs must only be appointed in the case of: (a) public authorities, (b) organizations that
engage in large scale systematic monitoring, or (c) organizations that engage in large
scale processing of sensitive personal data
Read Article 37

21.
GDPR MYTHS
GDPR IS A EUROPE ONLY ISSUE!
GDPR will affect any organisation that offers goods or services
to consumers in the EU or monitors the behaviour of people
located in Europe, regardless of where their offices or ad
servers are based.
Read REC 20, Article 4

22.
GDPR MYTHS
Controllers don’t need data processing agreements with
processors because the GDPR imposes direct obligations on
processors
Data processing agreements are vital to the controller and processor
relationship as it binds both parties to specific terms.
Read Article 28

23.
GDPR MYTHS
Biometric Data Is Sensitive Data UnderThe GDPR
Read Article 9

24.
GDPR MYTHS
Pseudonymised Data (E.G. Hashed Data) AreTreated Exactly Like
Any Other Personal Data UnderThe GDPR
The controller and the processor shall implement appropriate
technical and organisational measures to ensure a level of security
appropriate to the risk, including inter alias as appropriate:
(a) the pseudonymisation and encryption of personal data;
Read Article 33 and 11

25.
THE FINES
Article 83 splits the amount of administrative fines according to obligations infringed by
controllers, processors or undertakings.
2% of total worldwide turnover or 10,000,000EUR* 4% of total worldwide turnover or 20,000,000EUR*
Obligations of controller and processor under:
• Article 8 - Conditions applicable to child's consent in relation to
information society services
• Article 11 - Processing which does not require identification
• Art 25 to 39 - General obligations , Security of personal data ,
Data Protection impact assessment and prior consultation
• Article 42 - Certification
• Article 43 - Certification bodies
Obligations of certification body under:
• Art 42
• Art 43
Obligations of monitoring body under:
• Art 41(4)
Basic principles for processing and conditions for consent under:
• Art 5 - Principles relating to processing of personal data
• Art 6 - Lawfulness of processing
• Art 7 - Conditions for consent
• Art 9 - Processing of special categories of personal data
Data subject's rights under:
• Article - 12 to 22
Transfer of personal data to third country or international organization
under:
• Article - 44 to 49
Non Compliance with supervisory authority's powers under provisions of
Article 58:
• Imposition of temporary or definitive limitation including ban on
processing (Art 58 (2)(f))
• Suspension of data flows to third countries or international
organization (Art 58(2) (j))
• Provide access to premises or data processing equipment and means
(Art 58 (1) (f))
*Whichever is higher

26.
Record £400,000 Fine (October 2015 Attack)
Under GDPR this could of been up to £70m!
Accessed personal data of 156,959 customers including names,
addresses, DOB, phone numbers and email
15,656 cases, the attacker obtained bank details
Two early warnings –TELCO unaware!
FINANCIAL IMPACT EXAMPLE
ATELECOMMUNICATIONS PROVIDER
http://cybersecurityinsights.foregenix.com/post/102dpzf/gdpr-fines-to-make-your-eyes-water

27.
ICO’s in-depth investigation found that the attack could have been prevented if
TELCO had taken basic steps to protect customers’ information
Technical weaknesses inTELCO systems
Out of date database software
Did not scan infrastructure for possible threats
FINANCIAL IMPACT EXAMPLE

28.
“In spite of its expertise and resources, when it came to the basic principles of
cyber-security,TELCO was found wantingToday’s record fine acts as a warning to others
that cyber security is not an IT issue, it is a boardroom issue. Companies must be
diligent and vigilant.They must do this not only because they have a duty under law, but
because they have a duty to their customers”
UK ICO, Elizabeth Denham
FINANCIAL IMPACT EXAMPLE

29.
LEAD SUPERVISING AUTHORITY
(INFORMATION COMMISSIONERS OFFICE – ICO)
DATA PROCESSOR
(Service Provider)
EUROPEAN DATA PROTECTION BOARD
3rd COUNTRIES 3rd PARTY
DATA CONTROLLER
(Organisation)
DATA SUBJECT
(Individuals)
THE ESCALATION STRUCTURE (UK)

30.
12. INTERNATIONAL
Determine which data protection supervisory
authority you come under
11. DATA PROTECTION OFFICERS
Designate a data protection officer, or someone to
take responsibility for compliance. Review where
this role will sit in your organisation
10.DATA PROTECTION BY DESIGN
AND DATA PROTECTION IMPACT
ASSESSMENTS
Look into providing privacy impact assessments,
and when to implement them
9. DATA BREACHES
Ensure procedures in place to detect, report and
investigate breaches
7. CONSENT
Review how you are seeking, obtaining and
recording consent for any required changes
1. AWARENESS
Make your organisation aware of the changes and
impact of GDPR
2. INFORMATIONYOU HOLD
Document what personal data you hold, where it
came from and who you share it with
3. COMMUNICATING PRIVACY INFO
Review current privacy notices, plan for GDPR
change requirements
4. INDIVIDUALS’ RIGHTS
Review procedures to ensure covers all the rights
individuals have, including how you will delete or
provide data electronically
5. SUBJECT ACCESS REQUESTS
Update procedures and plan how you will manage
requests within new timescales
8. CHILDREN
Think about how you can verify individuals ages and
to gather parental/guardian consent for data
processing activities
6. LEGAL BASIS FOR PROCESSING
PERSONAL DATA
Review existing data processing carried out,
identify legal basis for carrying it out
ICO ADVISED APPROACH (UK)

31.
WHERE ORGANISATIONS ARE STRUGGLING
• Director level buy in
• Understanding of the impacts and risks to the business
• Lack of budget or resources
• Don’t understand what PII data is held or how it is captured

32.
MY ADVISED STARTING POINT
• Start planning your approach to GDPR compliance NOW
• Secure buy-in from key people (senior execs and board members)
• Evaluate the differences between the current law and the GDPR – concentrate where you
have gaps
• Document / understand what PII data you hold and where you obtained it from
• The GDPR places greater emphasis on the documentation that data controllers must keep to
demonstrate accountability
• Certain parts of the GDPR have more of an operational impact on some organizations than on
others

33.
VMware Product and Capabilities Mapped to
GDPR
• Micro-segmentation
• Automation, monitoring
• Audit features
• Logging
• Planning and designing network security
• Managing data flow
• Network isolation
• Workload segmentation
• Network monitoring
• Access control
• Protecting sensitive data
• Securing data exports
• Access controls with workloads and geotagging
• Access control with device location
• Multi-country data center design
• Monitoring and exposing network services via
API
• Reviewing network architecture
• Data protection including encryption
• Business continuity, visibility

34.
GDPR Article GDPR Description VMware Product and Capabilities
Article 18 Right to restriction of processing
VMware NSX
• NSX Distributed Firewall
• NSX Service Composer
• NSX Logical Switches
• NSX Guest Introspection
• NSX Network Extensibility
Article 24 Responsibility of the controller
VMware NSX
• NSX Application Rule Manager
• NSX Endpoint Monitoring
vRealize Network Insight
vRealize Operations
vRealize Log Insight
Article 25 Data protection by design and by default
VMware NSX
• NSX Service Composer
• NSX Endpoint Monitoring
• NSX Guest Introspection
vSphere
vShield Endpoint
Article 26 Joint controllers VMware NSX, NSX Distributed Firewall, vRealize Network Insight
Article 32 Security of processing
VMware NSX
• NSX Service Composer
• NSX Edge ServicesGateway
VMware vSphere
vCenter
VMware Data Protection
vSphere Replication
VMware vRealize Network Insight
VMware Site Recovery Manager
Article 35 Data protection impact assessment
VMware NSX
• NSX Application Rule Manager
vRealize Network Insight
NSX vRealize Log Insight

35.
WHEREVMWARE CAN ASSIST
• To learn more on howVMware can assist please visit theVMware booth or
attend GRC3109PE and/or GRC3386BES

36.
THANKYOU
VMWORLD EU 2017 -VMTN6642E
Kyle Davies – Solutions Architect
Blog: www.kyle-davies.com
Twitter: @kdavies1988