data compliance

Designing an infrastructure implies the fulfilment of general and specific requirements for security, access, data protection, anonymicity, data retention…

data access

The infrastructure should be design to grant the necessary access to the data and make sure that the infrastructure doesn’t violate any data protection law. We should first distinguish between:

Users are often not allowed to see any personal-sensitive data (apart from on spot maintenance from dev-ops people who might need to admin the servers, those sessions are time-limited and often recorded).

sensitive data

There are different categories of data which we can group as:

anonymization

In presence of sensitive data we can act on the database and:

retention and purpose

Data storage should consider the retention time frame for this kind of data source and the purpose for the storage of data. The retention goes along with purpose, some data producers are obliged to retain data for a certain time period in case of an audit or for financial reason.

To data producers and consumers different policies applies, for a data consumer without ownership of the data usually the purpose of the data usage should be clarified before granting the access and a certain retention policy should be put in place. A common scenarion for a data consumer is: