Questions tagged [gdpr]

For questions regarding the implementation of and impacts on design and operations in light of the EU General Data Protection Regulation.

7 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
0answers
97 views

How have you secured production data (PII) on non-prod environments?

Data protection laws including GDPR state: “Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that ...
1
vote
0answers
36 views

Do S3/Azure/GCS bucket names/keys represent personally identifiable information

We have an event-sourced system that uses a forward-only immutable event store. If we store personally identifiable information in this store, we'll be in trouble with regards to GDPR, as deletion ...
1
vote
0answers
264 views

GDPR compliance in Amazon AWS

Anybody has a nice checklist/todo list to achieve GDPR compliance in Amazon AWS environments? Want to use dev-sec.io checklists, OWASP for web app, AWS Trusted Advisor. Anything else to include/...
0
votes
1answer
86 views

How to protect email addresses in a customer database when you and other third parties must be able to send emails?

I am wondering what methods are used by big companies to protect customer email addresses in their databases. They usually have salespeople all over the world and multiple third-parties (Salesforce, ...
0
votes
0answers
43 views

Where to start with HIPAA Compliance?

I am trying to build an open-source EHR system with a database to store patients, doctors, and hospitals' information. I can design the database and build the actual system with the basic security in ...
0
votes
0answers
98 views

Tracking user's private link on google analytics: will it be a security issue for GDPR?

Our web portal track page access with google analytics. The access link will be then tracked and exposed in google analytics reports. As the portal include personally identifiable information (PII), ...
0
votes
1answer
115 views

Is it a possible vulnerability / GDPR violation if basic profile of users are enumerable through the URL?

If a website uses an auto-incrementing user-id in its url – /users/1, /users/2 to showcase public user profiles (just the name + photo / avatar) is it considered a possible vulnerability?