8

The General Data Protection Regulation (GDPR) is a set of rules to improve the protection of data about European citizens. Quote from this link:

The EU General Data Protection Regulation (GDPR) is the most important change in data privacy regulation in 20 years.

Refer to GDPR Key Changes for a summary of what it is all about, especially the Data Subject Rights, such as:

  • Breach Notification.
  • Right to Access.
  • Right to be Forgotten.
  • Data Portability.
  • Privacy by Design.
  • ...

Some GDPR facts:

  • GDPR will be enforced as of 25 May 2018 (that's pretty close).
  • Quote from GDPR Key Changes (about Territorial Scope):

    ... will apply to the processing of personal data by controllers and processors in the EU, regardless of whether the processing takes place in the EU or not. The GDPR will also apply to the processing of personal data of data subjects in the EU by a controller or processor not established in the EU, where the activities relate to: offering goods or services to EU citizens (irrespective of whether payment is required) and the monitoring of behaviour that takes place within the EU. Non-Eu businesses processing the data of EU citizens will also have to appoint a representative in the EU.

For anybody who is old enough to remember the Y2K-hype back in the 90s (i.e. the impact of it on IT systems): IMHO addressing all those Y2K issues was a piece of cake as compared to the challenge ahead with this GDPR thing.

Question(s): What is the impact of GDPR on DevOps, more specifically I wonder about:

  1. What kind of changes will be needed in the DevOps to make them GDPR-compliant?
  2. How can DevOps-practises help (facilitate, simplify, etc) a company to become GDPR-compliant, similar to how SCM tools helped in the 90s to become Y2K compliant?
  • Could you explain how a typical DevOps toolchain looks like according to you? – 030 Oct 8 '17 at 12:40
  • @030 please check my updated question (the link I added to clarify it). – Pierre.Vriens Oct 8 '17 at 12:47
  • Thank you. Now it is clear to me what you mean with the typical devops toolchain. I have added the components that are depicted in the image to prevent that the information is lost if the link will be deprecated. – 030 Oct 8 '17 at 12:59
  • I see that the toolchain tag already contains this information. The tag is clear enough. – 030 Oct 8 '17 at 13:33
3

"Enforcing" means lawyers going after possible culprits. Frankly, in my opinion (and those of some folks around me which are more a mix between IT-guy and lawyer), nobody knows how that will work out exactly.

Those iLawyers expect a lot of very interesting court cases in the first months to tests out the water, and see what precedence cases are going to come up. There will probably be plenty of law firms fishing for nice fat fish to fry.

For me personally, I don't really see that much impact specifically regarding DevOps. The applications themselves need to be adapted as necessary, obviously. Also, the actual data storage, be it RDBMS, elastic search indexes or whatever, will have to be looked at.

Aside from that, one benefit of DevOps, specifically if you work with some kind of container system and infrastructure-as-code is that you should generally know exactly where your data, log files etc. is stored, and what kind of them you have; much more so than in classical servers, where your data and especially logs might be strewn all over the place. It should also be very easy to regularly roll your data as applicable, i.e., get lost of old stuff.

So it can help to, for example, take your catalogue of i-a-c files and walk through them diligently - you can then be pretty sure to have found everything you need to be aware of.

0

With DevOps being a marriage between Dev and Ops (and even SecOps), I see different relationships with each one of them.

From the Dev aspect DevOps can help with GDPR compliance just like it can help with any other type of compliance required from software products: via (good) compliance QA testing.

As long as the compliance requirements are well defined it is possible to devise corresponding QA testing to verify those requirements. Simply by incorporating those QA verifications inside the products' DevOps chain - in the CI/CD pipelines, for example, the products' compliance can be measured and controlled.

From the Ops (and SecOps) prospective things are a bit different (I'm less familiar with these), but I presume GDPR will impose additional requirements which I suspect would translate into additional operating policies.

0

There is a direct impact of GDPR on DevOps as if one considers to use a new tool one should check and communicate with legal whether this is aligned with GDPR.

Analysis

What is the impact of GDPR on DevOps?

As DevOps is the intersection between Qa, Dev and Ops and DevOps automates processes from A to Z it is likely that people that are responsible in a company for documenting processes regarding GDPR will consult DevOps to find out where data is stored, what databases are used, if docker images are stored securely and how to proof that data is safe etc.

What kind of changes will be needed in the typical DevOps toolchain to make them GDPR-compliant?

It depends on what is the definition of a typical DevOps toolchain, but people that are responsible for documenting about GDPR are likely to consult DevOps about techniques that are used and could you explain why this option is secure and what do you do if there is a data leak?

Plan

Create

Verify

Package

Release

Configure

Monitor

  • What data is monitored?
  • If the monitor password is compromised, will this have impact on GDPR?

How can DevOps-practises help (facilitate, simplify, etc) a company to become GDPR-compliant, similar to how SCM tools helped in the 90s to become Y2K compliant?

One could decide to use a tool that visualizes the whole chain, e.g. from development to deployment to production. This will facilitate to find (potential) vulnerabilities and indicate the data flow and in what places it is stored.

  • What's the purpose of those "..." paragraphs? – Pierre.Vriens Oct 9 '17 at 9:18
  • @Pierre.Vriens I wanted to give examples that are related to each element. I have removed them for now – 030 Oct 9 '17 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.