Click here to close now.

Welcome!

Big Data Journal Authors: Elizabeth White, Liz McMillan, Pat Romanski, Carmen Gonzalez, John Wetherill

Related Topics: Cloud Expo, Java, Microservices Journal, Linux, Security, Big Data Journal

Cloud Expo: Article

Key Data Residency Requirements Global Organizations Need to Understand

…And some advice on how to satisfy them as you move to the cloud

One challenge more and more enterprises are grappling with as they plan to adopt the cloud is data residency & sovereignty. They are finding that if they want to use a cloud service hosted outside of their borders, life can become quite complex. Perhaps it is a result of the often discussed "Snowden Effect," but no one can deny that countries and regions are putting some strict guidelines in place to ensure privacy of sensitive data that is moving outside of their borders. These three examples are indicative of what I foresee we will be seeing much more of:

Australia: The Privacy Amendment Act
The Privacy Amendment Act introduced many changes to the original Privacy Act and just recently went into effect. The Act includes a set of new privacy principles that cover the processing of personal information by government agencies and businesses. The new principles are called jointly called the Australian Privacy Principles (APPs).

In the context of cloud adoption, agencies and businesses that deal with personal information are subject to APP8 (cross-border disclosure of personal information) which regulates the disclosure/transfer of personal information by an agency or business to a different entity (including a parent company) offshore. Before moving this type of data offshore, the Australian agency/business (Australian sender) must take reasonable steps to ensure the overseas recipient will comply with / not breach the APPs. The Australian Sender will remain liable for the overseas recipient's acts associated with any transferred personal information and, where relevant, be in breach of the APPs due to the overseas recipient's acts or omissions. In addition, APP11.1 (security of personal information) requires that an organization must "take reasonable steps to protect the personal information it holds from misuse".

Germany: The Federal Data Protection Act
Germany's Federal Data Protection Act is known as Bundesdatenschutzgesetz or BDSG, and these laws were reformed to cover a range of data protection-related issues. The key principles of the law state that organizations cannot collect any personally identifiable information without express permission from an individual (this includes obvious things like name and date of birth, as well as less obvious things like phone number, address and computer IP address). The permission that an individual grants must specify how, where, how long and for what purposes the data may be used and the individual can revoke the permission at any time.

Organizations must have policies, procedures and controls in place to protect all data types and categories that fall under the BDSG umbrella. Further, Germany does not recognize Safe Harbor regulations in the same way as other EU states (note - other EU states are re-examining this issue). It requires all parties involved in data transfer to assure that Safe Harbor requirements are met in a more formalized and structured manner.

In addition to the Federal Data Protection Act, components of the German criminal code regulate personal data protection, particularly for telecommunications, healthcare, and insurance companies. And all of the 16 German states have their own specific data protection laws pertaining to these areas.

United Kingdom: The UK Data Protection Act
The UK Data Protection Act is the UK's legislation covering the processing of data on people and is the main piece of legislation that governs the protection of personal data in the UK. The Act places clear demands upon those holding personal data in terms of the security that must be applied to protect it and it is necessary to apply a wide range of security measures to meet these standards:

  • Data must be processed fairly and lawfully
  • Data must be processed in accordance with the rights and freedoms of data subjects
  • Data must be protected against unauthorized or unlawful processing and against accidental loss, destruction or damage
  • Data must not be transferred to a country or territory outside the European Economic Area unless that country or territory protects the rights and freedoms of the data subjects.

The Information Commissioner's Office (ICO) is the UK's independent authority set up to uphold information rights in the public interest. They recently provided guidance around the use of cloud computing reiterating that the responsibility for data protection remains with the data controller (the enterprise). And particular consideration should be given to mitigating the security risks relating to personal data since foreign law enforcement agencies may have the power to demand access to personal data stored in a foreign data center. Failing to protect private data can result in ICO-levied fines.

What is an organization to do? Look exclusively at cloud solutions that are based wholly in the country where they operate? Avoid cloud services altogether? Both of these approaches are impractical. Enterprises need to adopt cloud-based solutions, the best ones available irrespective of location, in order to drive their businesses and remain competitive. So what to do? Technology in the form of Cloud Data Control Gateways (CDCGs) using a technique called tokenization can help.

CDCGs are increasingly being used by global organizations to meet data residency requirements. Using tokenization, where clear text data is replaced by a surrogate token (check out a cool infographic describing the technique here), sensitive data can remain physically onsite while only surrogate replacement tokens go to the cloud for processing and storage. This solution enables enterprises to use public cloud applications no matter where they are located because actual data never needs to leave their in-country data center where the tokenization process occurs. It is a simple and straightforward way to adhere to complex data residency/sovereignty requirements. For those concerned about the "Snowden Effect," the reality is that any requests for information through one of their US-based cloud providers cannot result in compromising customer or corporate data without the enterprise being part of the conversation.

Of course, not all tokenization technologies are created equal. This solution only works when it is designed and deployed properly so as to fulfill all data obfuscation goals and objectives. Most important, it needs to be part of a gateway approach that ensures that the functionality of the cloud application is not disrupted for cloud end users. For example, users need to be able to use the cloud as if the gateway was not in the middle of the equation at all (e.g., they need to be able to Search or Sort on data that has been tokenized).

Please check out our website, which offers more insights on data sovereignty and tokenization with specific pages addressing laws in a number of countries as well as sector-based requirements for verticals like Banking and Healthcare. We also provide various reference pieces, including a broader whitepaper, International Privacy Laws.

Read the original blog entry...


Perspecsys Inc. is a leading provider of cloud data tokenization and cloud encryption solutions that enable mission-critical cloud applications to be adopted throughout the enterprise. Cloud security companies like Perspecsys remove the technical, legal and financial risks of placing sensitive company data in the cloud. Perspecsys accomplishes this for many large, heavily regulated companies across the world by never allowing sensitive data to leave a customer's network, while maintaining the functionality of cloud applications. For more information please visit perspecsys.com or follow on Twitter @perspecsys.

More Stories By Gerry Grealish

Gerry Grealish is Vice President, Marketing & Products, at PerspecSys. He is responsible for defining and executing PerspecSys’ marketing vision and driving revenue growth through strategic market expansion and new product development. Previously, he ran Product Marketing for the TNS Payments Division, helping create the marketing and product strategy for its cloud-based payment gateway and tokenization/encryption security solutions. He has held senior marketing and leadership roles for venture-backed startups as well as F500 companies, and his industry experience includes enterprise analytical software, payment processing and security services, and marketing and credit risk decisioning platforms.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@BigDataExpo Stories
Big Data is amazing, it's life changing and yes it is changing how we see our world. Big Data, however, can sometimes be too big. Organizations that are not amassing massive amounts of information and feeding into their decision buckets, smaller data that feeds in from customer buying patterns, buying decisions and buying influences can be more useful when used in the right way. In their session at Big Data Expo, Ermanno Bonifazi, CEO & Founder of Solgenia, and Ian Khan, Global Strategic Positi...
Storage administrators find themselves walking a line between meeting employees’ demands to use public cloud storage services, and their organizations’ need to store information on-premises for security, performance, cost and compliance reasons. However, as file sharing protocols like CIFS and NFS continue to lose their relevance, simply relying only on a NAS-based environment creates inefficiencies that hurt productivity and the bottom line. IT wants to implement cloud storage it can purchase a...
The cloud is everywhere and growing, and with it SaaS has become an accepted means for software delivery. SaaS is more than just a technology, it is a thriving business model estimated to be worth around $53 billion dollars by 2015, according to IDC. The question is - how do you build and scale a profitable SaaS business model? In his session at 15th Cloud Expo, Jason Cumberland, Vice President, SaaS Solutions at Dimension Data, discussed the common mistakes businesses make when transitioning t...
In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect at GE, and Ibrahim Gokcen, who leads GE's advanced IoT analytics, focused on the Internet of Things / Industrial Internet and how to make it operational for business end-users. Learn about the challenges posed by machine and sensor data and how to marry it with enterprise data. They also discussed the tips and tricks to provide the Industrial Internet as an end-user consumable service using Big Data Analytics and Industrial C...
Are your Big Data initiatives resulting in Big Impact or Big Mess? In her session at Big Data Expo, Penelope Everall Gordon, Emerging Technology Strategist at 1Plug Corporation, shared her successes in improving Big Decision outcomes by building stories compelling to the target audience – and her failures when she lost sight of the plotline, distracted by the glitter of technology and the lure of buried insights. The cast of characters includes the agency head [city official? elected official?...
More organizations are embracing DevOps to realize compelling business benefits such as more frequent feature releases, increased application stability, and more productive resource utilization. However, security and compliance monitoring tools have not kept up and often represent the single largest remaining hurdle to continuous delivery. In their session at DevOps Summit, Justin Criswell, Senior Sales Engineer at Alert Logic, Ricardo Lupo, a Solution Architect with Chef, will discuss how to ...
The explosion of connected devices / sensors is creating an ever-expanding set of new and valuable data. In parallel the emerging capability of Big Data technologies to store, access, analyze, and react to this data is producing changes in business models under the umbrella of the Internet of Things (IoT). In particular within the Insurance industry, IoT appears positioned to enable deep changes by altering relationships between insurers, distributors, and the insured. In his session at @Things...
17th Cloud Expo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterprises a...
Move from reactive to proactive cloud management in a heterogeneous cloud infrastructure. In his session at 16th Cloud Expo, Manoj Khabe, Innovative Solution-Focused Transformation Leader at Vicom Computer Services, Inc., will show how to replace a help desk-centric approach with an ITIL-based service model and service-centric CMDB that’s tightly integrated with an event and incident management platform. Learn how to expand the scope of operations management to service management. He will al...
The truth is, today’s databases are anything but agile – they are effectively static repositories that are cumbersome to work with, difficult to change, and cannot keep pace with application demands. Performance suffers as a result, and it takes far longer than it should to deliver new features and capabilities needed to make your organization competitive. As your application and business needs change, data repositories and structures get outmoded rapidly, resulting in increased work for applica...
The Workspace-as-a-Service (WaaS) market will grow to $6.4B by 2018. In his session at 16th Cloud Expo, Seth Bostock, CEO of IndependenceIT, will begin by walking the audience through the evolution of Workspace as-a-Service, where it is now vs. where it going. To look beyond the desktop we must understand exactly what WaaS is, who the users are, and where it is going in the future. IT departments, ISVs and service providers must look to workflow and automation capabilities to adapt to growing ...
One of the biggest impacts of the Internet of Things is and will continue to be on data; specifically data volume, management and usage. Companies are scrambling to adapt to this new and unpredictable data reality with legacy infrastructure that cannot handle the speed and volume of data. In his session at @ThingsExpo, Don DeLoach, CEO and president of Infobright, will discuss how companies need to rethink their data infrastructure to participate in the IoT, including: Data storage: Understand...
Since 2008 and for the first time in history, more than half of humans live in urban areas, urging cities to become “smart.” Today, cities can leverage the wide availability of smartphones combined with new technologies such as Beacons or NFC to connect their urban furniture and environment to create citizen-first services that improve transportation, way-finding and information delivery. In her session at @ThingsExpo, Laetitia Gazel-Anthoine, CEO of Connecthings, will focus on successful use c...
In his session at DevOps Summit, Tapabrata Pal, Director of Enterprise Architecture at Capital One, will tell a story about how Capital One has embraced Agile and DevOps Security practices across the Enterprise – driven by Enterprise Architecture; bringing in Development, Operations and Information Security organizations together. Capital Ones DevOpsSec practice is based upon three "pillars" – Shift-Left, Automate Everything, Dashboard Everything. Within about three years, from 100% waterfall, C...
With the arrival of the Big Data revolution, a data professional is expected to master a broad spectrum of complex domains including data processing, mathematics, programming languages, machine learning techniques, and business knowledge. While this mastery is undoubtedly important, this narrow focus on tool usage has divorced many from the imagination required to solve real-world problems. As the demand for analysis increases, the data science community must transform from tool experts to "data...
Thanks to Docker, it becomes very easy to leverage containers to build, ship, and run any Linux application on any kind of infrastructure. Docker is particularly helpful for microservice architectures because their successful implementation relies on a fast, efficient deployment mechanism – which is precisely one of the features of Docker. Microservice architectures are therefore becoming more popular, and are increasingly seen as an interesting option even for smaller projects, instead of bein...
DevOps tends to focus on the relationship between Dev and Ops, putting an emphasis on the ops and application infrastructure. But that’s changing with microservices architectures. In her session at DevOps Summit, Lori MacVittie, Evangelist for F5 Networks, will focus on how microservices are changing the underlying architectures needed to scale, secure and deliver applications based on highly distributed (micro) services and why that means an expansion into “the network” for DevOps.
How do APIs and IoT relate? The answer is not as simple as merely adding an API on top of a dumb device, but rather about understanding the architectural patterns for implementing an IoT fabric. There are typically two or three trends: Exposing the device to a management framework Exposing that management framework to a business centric logic Exposing that business layer and data to end users. This last trend is the IoT stack, which involves a new shift in the separation of what stuff happe...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo in Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading in...
The 3rd International @ThingsExpo, co-located with the 16th International Cloud Expo – to be held June 9-11, 2015, at the Javits Center in New York City, NY – is now accepting Hackathon proposals. Hackathon sponsorship benefits include general brand exposure and increasing engagement with the developer ecosystem. At Cloud Expo 2014 Silicon Valley, IBM held the Bluemix Developer Playground on November 5 and ElasticBox held the DevOps Hackathon on November 6. Both events took place on the expo fl...