Data Protection Tooling in YaaS

Data Protection Tooling in YaaS

The General Data Protection Regulation

The General Data Protection Regulation, GDPR, was approved in April 2016 and replaces the existing Data Protection Directive as of May 25th, 2018. The regulation’s aim is to protect data privacy for all European citizens. Data Protection Requirements GDPR ensures, among other things, the following data subject rights:

• The right to access/data portability requirement – the data subject’s right to request information about all personal data that the data controller stores about them, and to receive a copy of the whole data set in readable, electronic format, free of charge.
• The right to be forgotten – the right enabling the data subjects to request their personal data erasure.
• Audit logs – changes to personal data must be logged and available for data subject.

Scenario

YaaS serves multiple types of users, therefore multiple scenarios must be considered:

• Users having the YaaS account
  • Platform internal users. For example, security and data protection officers, services’ developers
  • Users developing their solution based on YaaS – organizations. For example, administrators, data protection officers (DPOs) and product managers without admin rights
• Organizations’ customers without a YaaS account
  • People who have a record with personal data in the customer service

For users with a YaaS account, YaaS acts as a data controller, while for customers YaaS is only a data processor.

Tooling provided by YaaS

To provide a unified approach to data protection, and to enable YaaS users to fulfill all the requirements, YaaS introduces the following tools:

• The Transparency service
  • Documentation
  • 
• The Deletion service
  • Documentation
  • 
• The Audit Ingestion and Audit Retrieval services
  • 
• Detailed guidelines describing the use of the solution, and steps to be taken to fulfill data protection requirements
  • Developer Guidelines for Data Privacy

Broad overview of the solution