GDPR Industriali Di Napoli – 8 Novembre 2017
Total Page:16
File Type:pdf, Size:1020Kb
Continuità Operativa e Protezione dei Dati UnioneGDPR Industriali di Napoli – 8 Novembre 2017 Workshop March 2017 Roberto Lotti – Partner System Engineer [email protected] Articoli rilevanti del GDPR Articolo 5 Principi relativi al processo dei Dati Personali 1. Personal data shall be: a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘ purpose limitation ’); c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘ data minimisation ’); d) accurate and, where necessary, kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘ accuracy ’); e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’); f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage , using appropriate technical or organisational measures (‘ integrity and confidentiality ’). 3 Articolo 25 Protezione dei Dati by Design e by Default 1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organizational measures , such as pseudonymisation, which are designed to implement data- protection principles, such as data minimisation , in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. 2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed . That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility . In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons. 4 Article 32 Sicurezza nel Processo dei dati 1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: a) the pseudonymisation and encryption of personal data; b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing. Articolo 34 Comunicazione di “Data Breach” personali al soggetto interessato 1. The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met: a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption ; 5 Soluzioni Prodotti & Tecnologie DellEMC per il GDPR Solutions Mapping ° Centralised GRC Framework ° IT Risk Management ° Enterprise Risk Management ° Automated data life-cycle management ° Compliance Management ° Compliance Management Service ° Audit Management Strategy Service ° Data Breach Workflow Management Design ° Business Continuity Solution ITIL ° Resilient solutions to cyber-attack ° Third parties governance v3 ° Identity & Access Management Service ° Incident & Breach Operation Management Service ° Security Information and Transition event management ° Monitor, detection, ° Compliance Management Response ° Change Management Workflow ° Centralised GRC Framework ° Centralised GRC Framework ° Security Information and Event Mgmt 7 ° Compliance Management Service Strategy & Service Design Technology Area Principles Topics Solutions 24 Service ° Accountability ° Enterprise Risk Management ° RSA Archer 83 Strategy ° Service Assurance ° Compliance Management ° RSA Archer 5 ° Dell EMC Isolated Recovery Solution (IRS) 9 ° Accountability ° Dell EMC VMAX SnapVX 35 ° Risk Mitigation ° Centralised GRC Framework ° Dell EMC VMAX FAST/FAST VP 24 ° Privacy by Design ° IT Risk Management ° Dell EMC Avamar ° Least Privilege 33 ° Automated data life-cycle management ° Dell EMC Networker ° Segregation of ° Compliance Management ° Dell EMC RecoverPoint 34 Service Duties ° Audit Management ° Dell EMC VPLEX 40 Design ° Need to Know ° Data Breach Workflow Management ° Dell EMC SC Compellent – Live Volume 42 ° Due Diligence ° Business Continuity Solution ° Dell EMC Data Domain (DD) 25 ° Compliance Assurance ° Resilient solutions to cyber-attack ° Dell EMC Data Protection Advisor (DPA ) 32 ° Privacy by Design ° Third parties governance ° Dell EMC Elastic Cloud Storage (ECS) 44 ° Chain of Custody ° Dell EMC Mozy 45 ° Dell EMC Spanning 8 ° VirtuStream Service Transition & Service Operation Technology Area Principles Topics Solutions 24 ° RSA Archer 40 ° Dell EMC Avamar 42 ° Awareness ° Dell EMC Networker Service ° Accountability ° Compliance Management ° Dell EMC Data Domain (DD) Transition ° Due Diligence ° Change Management Workflow ° Dell EMC Data Protection Advisor (DPA) ° Service Assurance ° Dell EMC Tape Remediation ° Dell EMC Elastic Cloud Storage (ECS) ° VirtuStream 30 ° RSA Archer 33 ° Accountability ° Identity & Access Management ° RSA NetWitness 34 ° Due diligence ° Incident & Breach Management ° Dell EMC Data Protection Advisor (DPA) ° Dell EMC Elastic Cloud Storage (ECS) 12 Service ° Least Privilege ° Security Information and event Operation management ° Segregation of ° Dell EMC SourceOne 18 Duties ° Monitor, Detection, Response ° Dell EMC DP Search 20 ° Need to Know ° Centralised GRC Framework ° Dell EMC Mozy 921 ° Dell EMC Isilon Search Soluzioni Prodotti & Tecnologie DellEMC per il GDPR Obiettivi Perchè i clienti hanno bisogno di una strategia di BC / DR Spiegare possibilità, capacità e scelte Comprendere BC e DR da un punto di vista tecnologico Descrivere le principali soluzioni DellEMC per la BC ed il DR 11 Business Continuity e Disaster Recovery: fattori decisionali Considerazioni Considerazioni Di Business Tecniche Consistency Cost and Recovery Functionality, Capacity Availability Recovery-Time Bandwidth Objectives Recovery-Point Performance Objectives PRIMARY DECISION DRIVERS 12 Una differenza chiave Comprendere bene la differenza tra Disaster Recovery (DR) e Business Continuity (BC) • Disaster Recovery: Ripristinare le operazioni IT a seguito di un “site failure” • Business Continuity: Ridurre, fino ad eliminarli, i “downtime” applicativi 13 L’impatto della Business Continuity Productivity Impact Revenue Impact • Employees affected • Direct + Indirect losses • Email ! • Compensatory payments • Systems • Lost future revenue Brand Impact Financial Impact • Customers • Revenue recognition • Suppliers • Cash flow • Financial markets • Banks • Business partners • The Media 14 Dell EMC Data Protection Continuum Disponibilità, Replica, Backup & Archiviazione Un portafoglio completo per venire incontro a qualsiasi esigenza di “data protection” Availability Replication Snapshot Backup Archive Zero Seconds Minutes Hours 15 Protezione dei Dati ovunque Modelli di Private / Public consumo Converged On-Prem Virtualized Infrastructure Cloud Dove RTO & RPO vuoi Continuous Replication Snaps Backup Archive Encryption Isolated Recovery Availability Il meglio del Convergente Software Defined As-a-Service Multi-Cloud meglio Come APP vuoi 16 DellEMC Storage Integrated Offerings SC Family Unity Family XtremIO Family VMAX AF Family COMMON TOOLS FOR MANAGEMENT, MOBILITY & PROTECTION