How to Achieve Compliance with GDPR Article 17 in a Hybrid Cloud Environment

Abstract

On 25 May 2018, the General Data Protection Regulation (GDPR) Article 17, the Right to Erasure (“Right to be Forgotten”) came into force, making it vital for organisations to identify, locate and delete all Personally Identifiable Information (PII) where a valid request is received from a data subject to erase their PII and the contractual period has expired. This must be done without undue delay and the organisation must be able to demonstrate that reasonable measures were taken. Failure to comply may incur significant fines, not to mention impact to reputation. Many organisations do not understand their data, and the complexity of a hybrid cloud infrastructure means they do not have the resources to undertake this task. The variety of available tools are quite often unsuitable as they involve restructuring so there is one centralised data repository. This research aims to demonstrate that compliance with GDPR’s Article 17 Right to Erasure (“Right to be Forgotten”) is achievable in a hybrid cloud environment by following a list of recommendations. However, full retrieval, all of the time will not be possible, but we show that small organisations running an ad-hoc hybrid cloud environment can demonstrate that reasonable measures were taken to be Right to Erasure (“Right to be Forgotten”) compliant.

Sci: An Inclusive, Multidisciplinary Scientific Journal

“…Accordingly, organizations must identify, locate and delete personally identifiable information, after the contractual period has expired and where a valid request is received from the data subject. Kelly et al set out to evaluate the implementation and role of the Right to Erasure and demonstrate that compliance is achievable with a hybrid cloud environment [8]. In the context of material sciences, Baumgartner et al report on a new approach to process coordination polymers of iron(II) and 4-amino-1,2,4triazole (NH 2 trz) [9].…”

Towards Software-Defined Data Protection: GDPR Compliance at the Storage Layer is Within Reach

“…A vast majority of companies today rely on cloud services providers, for their infrastructural needs, making GDPR compliance in cloud environments a necessity. Therefore, rich related work proposes frameworks enabling cloud users to develop GDPR-compliant applications [32], along with studies that outline the challenges faced by cloud users in the face of GDPR [9], and the support for the right to be forgotten in hybrid clouds [18].…”