Accelerate GDPR compliance with the Microsoft Cloud Ole Tom Seierstad National Security Officer Microsoft Norway This presentation is intended to provide an overview of GDPR and is not a definitive statement of the law.
GDPR Compliance Simplify your privacy journey Uncover risk & take action Leverage guidance from experts
Centralize, Protect, Comply with the Cloud Process all in one place Centralize processing in a single system, simplifying data management, governance, classification, and oversight. Maximize your protections Protect data with industry leading encryption and security technology that s always up-to-date and assessed by experts. Streamline your compliance Utilize services that already comply with complex, internationallyrecognized standards to more easily meet new requirements, such as facilitating the requests of data subjects.
Protecting customer privacy with GDPR
46% 99.9% 23% 50%
We will stand behind you with contractual commitments for our cloud services that: Meet stringent security requirements Support customers in managing data subject requests Provide documentation that enables customers to demonstrate compliance for all the other requirements of the GDPR applicable to processors and more Microsoft was the first major cloud services provider to make these commitments to its customers. Our goal is to simplify compliance for our customers with both the GDPR and other major regulations. The GDPR commitments are now available in the Online Services Terms (OST) at www.microsoft.com/licensing
How do I get started? 1 Discover Identify what personal data you have and where it resides 2 Manage Govern how personal data is used and accessed 3 Protect Establish security controls to prevent, detect, and respond to vulnerabilities & data breaches 4 Report Keep required documentation, manage data requests and breach notifications
1 Discover: Example solutions Microsoft Azure Microsoft Azure Data Catalog In-scope: Inventory: Enterprise Mobility + Security (EMS) Microsoft Cloud App Security Dynamics 365 Audit Data & User Activity Reporting & Analytics Office & Office 365 Data Loss Prevention Advanced Data Governance Office 365 ediscovery SQL Server and Azure SQL Database SQL Query Language Windows & Windows Server Windows Search
2 Manage: Example solutions Data governance: Data classification: Microsoft Azure Azure Active Directory Azure Information Protection Azure Role-Based Access Control (RBAC) Enterprise Mobility + Security (EMS) Azure Information Protection Dynamics 365 Security Concepts Office & Office 365 Advanced Data Governance Journaling (Exchange Online) Windows & Windows Server Microsoft Data Classification Toolkit
3 Protect: Example solutions Preventing data attacks: Detecting & responding to breaches: Microsoft Azure Azure Key Vault Azure Security Center Azure Storage Services Encryption Enterprise Mobility + Security (EMS) Azure Active Directory Premium Microsoft Intune Office & Office 365 Advanced Threat Protection Threat Intelligence SQL Server and Azure SQL Database Transparent data encryption Always Encrypted Windows & Windows Server Windows Defender Advanced Threat Protection Windows Hello Device Guard
4 Report: Example solutions Microsoft Trust Center Service Trust Portal Record-keeping: Reporting tools: Microsoft Azure Azure Auditing & Logging Azure Data Lake Azure Monitor Enterprise Mobility + Security (EMS) Azure Information Protection Dynamics 365 Reporting & Analytics Office & Office 365 Service Assurance Office 365 Audit Logs Customer Lockbox Windows & Windows Server Windows Defender Advanced Threat Protection
Responsibility SaaS PaaS IaaS On-prem Data governance & rights management Client endpoints Account & access management Identity & directory infrastructure Application Network controls Operating system Physical hosts Physical network Physical datacenter Microsoft Customer
38 Cloud regions worldwide North Central US United Kingdom South West US 2 West Central US West US US Gov Arizona 3 US Gov Texas 3 Central US US Gov Iowa US DoD West South Central US Canada Central US Gov Virginia Canada East US DoD East United Kingdom West East US East US 2 North Europe France 3 France 3 West Europe Germany Northeast 2 Germany Central 2 West India Central India China West 1 China East 1 South India Korea Central 3 East Asia Korea South 3 Japan East Japan West 100+ datacenters One of 3 largest networks in the world Southeast Asia 1 China datacenters operated by 21 Vianet 2 German data trustee services provided by T-systems 3 France, South Korea and US Gov datacenter regions have been announced but are not currently operational Brazil South Australia Southeast Australia East Global datacenters Sovereign datacenters
Our commitment to you To simplify your path to compliance, we are committing to GDPR compliance across our cloud services when enforcement begins on May 25, 2018. We will share our experience in complying with complex regulations such as the GDPR. Together with our partners, we are prepared to help you meet your policy, people, process, and technology goals on your journey to GDPR.
REGIONAL INDUSTRY US GOV GLOBAL Azure has the deepest and most comprehensive compliance coverage in the industry ISO 27001 ISO 27018 ISO 27017 ISO 22301 ISO 9001 SOC 1 Type 2 SOC 2 Type 2 SOC 3 CSA STAR Self-Assessment CSA STAR Certification CSA STAR Attestation Moderate JAB P-ATO High JAB P-ATO DoD DISA SRG Level 2 DoD DISA SRG Level 4 DoD DISA SRG Level 5 SP 800-171 FIPS 140-2 Section 508 VPAT ITAR CJIS IRS 1075 PCI DSS Level 1 CDSA MPAA FACT UK Shared Assessments FISC Japan HIPAA / HITECH Act HITRUST GxP 21 CFR Part 11 MARS-E IG Toolkit UK FERPA GLBA FFIEC Argentina PDPA EU Model Clauses UK G-Cloud China DJCP China GB 18030 China TRUCS Singapore MTCS Australia IRAP/CCSL New Zealand GCIO Japan My Number Act ENISA IAF Japan CS Mark Gold Spain ENS Spain DPA India MeitY Canada Privacy Laws Privacy Shield Germany IT Grundschutz workbook
Microsoft.com/GDPR
Discover Manage Protect Report Search & identify personal data Control access Classify data Protect data in the cloud Detect & Remediate threats Recordkeeping Integrate Azure search for hosted applications to locate personal data across user-defined indexes Trace and identify personal data stored in different data sources Securely manage access to your data, applications and other resources Enforce separation of duties Easily determine and assign relative values to your data Employ advanced encryption, cryptography, and monitoring Restore data availability with a variety of recovery and Georedundant storage options Proactively prevent, detect and respond quickly to threats Deliver verifiable transparency and delivers tamper-resistant insights with activity log Leverage comprehensive compliance and privacy documentation for Azure
Discover Manage Protect Report Identify personal data Control access Set retention policies Classify content Safeguard environment Respond to threats Recordkeeping Transparency assurances Utilize ediscovery templates to identify types of personal data Easily find, classify, set policies on and manage data with Advanced Data Governance Use Advanced ediscovery to export and/or delete personal data from Exchange, SharePoint, etc. Archive and preserve content across your Office 365 systems Protect email from today s sophisticated malware attacks with Advanced Threat Protection Prevent sensitive records from being used by unauthorized users with Data Loss Protection Conduct risk assessments using built-in tools in the Service Assurance Dashboard Track and report on user activities with detailed Audit Logs Automatically protect against accidental disclosure by enforcing policy on sensitive data Proactively uncover and protect against advanced threats and risks with Threat Intelligence and Advanced Security Management
Discover Manage Protect Report Identify personal data Classify & label data Protect data, identities, devices & apps Detect threats & remediate Gain rich logging & reporting Quickly identify sensitive data across your environment with Azure Information Protection Discover cloud apps in your environment Gain deeper visibility into user activity Define a classification scheme for better data manageability Use Azure Information Protection to configure policies for classifying, labeling and protecting personal data Deliver consistent data protection with Azure Information Protection Protect personal data with risk-based conditional access and Privileged Identity Management Protect data in mobile devices and mobile apps with Microsoft Intune Detect data breaches with behavioral analytics and anomaly detection technologies Gain rich logging and reporting to analyze how sensitive data is distributed Monitor activities on shared data and revoke access in unexpected events with Azure Information Protection
Discover Manage Protect Report Identify and track personal data Control access Safeguard data Respond to breaches Recordkeeping Easily query databases to uncover personal data Tag data with sensitivity labels using Extended Properties Securely authenticate to your database and apply granular authorization policies Restrict access to users using Dynamic Data Masking and Row-Level Security Encrypt data whether at rest, in transit or in client applications Track and log database events to identify potential threats or security violations Use continuously learning algorithms to identify unusual or suspicious activity Track and report on all database activities with granularly configurable auditing
Discover Manage Protect Report Identify personal data Control access Classify content Define access privileges Monitor service status Recordkeeping Create reports that uncover personal data Discover, analyze and visualize personal data using Power BI Securely manage access to your data by roles, applications and other resources Classify data and protect against accidental disclosure Protect data by limiting access based on user roles Restrict access to specific highimpact fields or records Monitor service health and stayup-to-date on the latest security updates Explore Microsoft s comprehensive documentation on Dynamics 365 s compliance, security, privacy and trust offerings
Discover Manage Protect Report Locate personal data Meet compliance requirements Safeguard environment Respond to threats Recordkeeping Uncover personal data on local and connected machines Utilize sample search expression and rules to ease compliance requirements Move from password to more secure forms of authentication Protect devices with both detection-based solutions and secure-by-design techniques Audit detailed user and application actions to meet reporting auditing requirements Prevent data from leaking to unauthorized documents or locations Easily detect, investigate, contain and respond to data breaches on your network