Talk on how to build GDPR compliant services in AWS London User Group on 18th April 2018 at London's skills Matters.

1. Building GDPR compliant
Services in AWS
Karthik Selvaraj
Principal Consultant,
Purple Bytes Ltd.

2. About me
• Professional AWS Certified Solution Architect
• Master’s in Software systems.
• 10 years experience in building cloud based digital platforms.
• Specialisation - Security by Design, Privacy by Design, IdM, API
Management and Micro Services.

3. This is not
• A Legal and privacy advisory
• About legacy application integration
• About licensed products or SaaS.
• e.g., CRM, SRM, Word processors, accounting software.

4. GDPR Highlights
Euro
potential penalty per
incident
Fair and
Lawful
Retention RightsPurposes Adequacy Accuracy

5. GDPR – Individual Rights
Right to be
Informed
Right of
Access
Right of
Rectification
Right to
restrict
processing
Right of
data
portability
My Rights!
Right to
object
Rights in
relation to
automated
decision
making and
profiling
Right of
erasure

6. Are you ready for 25th May 2018???

7. In house Technology
Stack
Agencies
delivering
newsletter
PR, AD agencies,
Marketing, Social
media partners
User
Media Company
Data Subject
Data
Controller
Data
Processors
Regulators
Auditors,
Regulators
Example
Data processors
could be Data
Controllers too!

8. GDPR Overview
Customer – Data Subject
Regulator - ICO
Company - Controller
Suppliers - Processors
Consent
Data Rights
Breach Notification
Data Portability
Breach Notification
Compliance Audit
Fines
Must implement technical &
Organisation Measures (TOMs)
Breach notification
Content agnostic TOMs
Breach Notification

9. GDPR as a “shared responsibility”
Slide courtesy AWS

10. Technical & Organisational Measures
Pseudonymisation
and encryption of
personal Data
Ensure ongoing
confidentiality,
integrity,
availability and
resilience of
processing
systems and
services
Ability to restore
availability and
access to
personal data in
a timely manner
in the event of
physical or
technical
incident
Process for
regularly testing,
assessing and
evaluating the
effectiveness of
TOMs

11. GDPR – Data classification
Personal Data Pseudonymised data Anonymised data
Under GDPR scope Mostly under GDPR scope Not under GDPR scope
Natural Living person
identity
Not possible to directly
identify. Process for re-
identification exists
Not Identifiable and no
process for re-
identification
Name, date of birth,
address
Foreign Key to Personal
data
Random identifier not
correlated to personal
data

12. Navigating GDPR Compliance
Slide courtesy AWS

13. How to handle
13
Breach Personal
Data
Rights Consent

14. Good News!
AWS is one of the Processor.
And it is GDPR Compliant

15. What AWS provides to help you become compliant
Tools and Services
Compliance Framework
Partner Network
Data Protection Terms
Slide courtesy AWS

16. Compliance Framework
Slide courtesy AWS

17. Key AWS Market Place tools
Advanced Threat
Analytics
Application Security
Server & End Point
protection
Vulnerability and Pen
test
Network Security
Encryption and Key
Management
SafeNet Slide courtesy
AWS

18. What
How
18
GDPR – Systems Overview
With
What
Database Storage
Transactions
Analytics
Encryption
Pseudonymised
Backup
Archival
Key Management
Consent
Management
ComputeSecurity
Rights
Management
Personal Data
Management
Breach
Management

19. Version
Controlled
Consent
API GatewayCloudFront
distribution
AWS Simple Icons: Example
Amazon
Route 53
Managing Consent – Collect and Store
DynamoDB
Data Flow
Map
Personal
Data
Data Subject
Regulators
ProcessorsController

20. Consent
API GatewayCloudFront
distribution
AWS Simple Icons: Example
Amazon
Route 53
Managing Consent - Process
DynamoDB Data Flow
Map
Personal
Data
SNS
Step Function SNS
Decider Worker
ECS EC2 RDS
Data Subject
Regulators
ProcessorsController

21. API
Gateway
CloudFront
distribution
Amazon
Route 53
Managing Rights - Cascade
Rights
Management
DynamoDB
Data Flow
Map
Personal
Data
Step Function
Decider
Amazon S3
Data Subject
Regulators
ProcessorsController

22. AWS Simple Icons: Example
Managing Breach
Security
Monitoring
Operational
Monitoring
Compliance
Monitoring
CloudTrail
Macie
Guard
Duty
AWS
Config
Trusted
Advisor
Flow logs
IAM STS
KMS Cloud
HSM
Serverside
Encryption
SAML Federation
Service
Catalog
Identity
Security MonitoringEncryption
SDLC
Code
star
Repo
Central
Logging
Account

24. If you are interested to have chat/consultation you can contact me at
Karthik@Purplebytes.co.uk
https://uk.linkedin.com/in/karthiselvaraj
@purplebytestech