Support Right To Be Forgotten requests with a backup solution
Right to Erasure, also known as Right To Be Forgotten, is easily one of the most discussed and possibly, contentious elements of the European Union’s General Data Protection Regulation (GDPR). It mandates enterprises to keep user data private and eliminate such data when requested by the EU person.
“The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay,” says Article 17 of GDPR.
Under GDPR, the penalty for non-compliance can be severe – 4% of annual revenues or €20 million – whichever is higher.
Under GDPR, the penalty for non-compliance can be severe – 4% of annual revenues or €20 million – whichever is higher. Worse, in some cases, the Data Protection Authority can enforce a complete ban on data processing activity by an organization. It can severely impact a company’s goodwill, an intangible asset that isn’t easy to measure in any monetary terms.
While in theory, the “Right to be Forgotten” sounds simple and straightforward, finding and removing all data belonging to a person can be incredibly complex, especially for organizations with no strategic planning for data management and visibility. Considering that an organization’s data not only resides on its central file or Database servers but rather also on employee’s desktops, laptops, mobile devices, and SaaS applications, and backups, it becomes difficult to comply with Right To Be Forgotten requests.
Finding and removing all data belonging to a person can be incredibly complex, especially for organizations with no strategic planning for data management and visibility.
An enterprise’s data management strategy needs to support the business’ need for regulatory compliance and should allow complete visibility and awareness of where all their data resides – who it belongs to, whether it is structured or unstructured data, whether access permissions are being adequately enforced, retention rules etc. And, in the light of GDPR it should allow a secure way to identify and delete requested data with minimal disruption to business operations.
Right To Be Forgotten request and Backup Solution
One of the repositories from where it is particularly troublesome to find and remove personal data is from data backups. Backups traditionally have been recorded to media such as tape that doesn’t lend itself to partial erasure of data. Also, tape media are many times, stored offsite, and request such as the “right to be forgotten” would trigger a recall of all media in order to painstakingly search through and identify information to be deleted.
Parablu’s BluVault enables businesses to be prepared to manage Right to be Forgotten requests in an effective and efficient way. Parablu’s backup media is invariably disk storage or object storage. By virtue of such storage being always accessible, searching for, and identifying pertinent information to delete is vastly simpler. Secondly, Parablu’s data cataloging approaching lends itself to identification and removal of user data – even down to a single file. Thus, a backup can be surgically modified to remove any offending data – and the rest of the backup can still be preserved per the original retention rules. All such surgical data removal operations (called an Administrative Delete) are allowed only by authorized Admininistrators. Further, all such operations are audit logged to not only provide the organization a trail of activity – but also to produce as evidence to a regulatory body or the EU person – that the data erasure was accomplished.
Parablu’s BluVault enables businesses to be prepared to manage Right to be Forgotten requests in an effective and efficient way.
Here is how an IT admin can browse through all backups and “Administratively” delete backed-up files/folders using Parablu’s web portal. It involves four important steps:
- Enabling administrators to delete other users’ data
- Creating a deletion policy for the users
- Deletion of the data from an identified user/device
- Excluding such folders for future backups
Enabling administrators to delete other users’ data
This step involves setting up a global policy that allows administrators including “Delegated Administrators” to delete data from a user’s backups.
1. Login to the Parablu Portal
2. On the Parablu Portal home screen, go to the Settings tab
3. On the Settings page, click on Global Settings
4. On the Parablu Installation Properties page, under the Data Management section, select Enabled for the Can Administrator delete other users’ data option.
5. Click on Save to complete
Creating a deletion policy for the users
After Administrator Deletion is enabled on the Global Settings page, you should also ensure that the same ability is also enabled at a policy level.
1. First identify the user for whom the Administrative Delete operation needs to be performed
2. Login to the Parablu Portal
3. Go to the Users tab and find the user in question. Determine the policy the user is currently assigned to. (say Policy A).
4. Next, go to the Policy Management tab
5. On the Policy Management page, click the Backup Policies option
6. On the Backup Policies page, click the Create New Policy button
7. On the Create New Policy page, go to Advanced tab and select Yes under the Can Administrator Delete User Data option
8. Ensure that all other settings in the newly created policy are the same as that of Policy A. To make this easier, BluVault also offers a Clone Policy option which you can use instead of creating a new policy.
9. Click on Save to complete
10. Once saved, remove the user (for whom Administrative Delete is to be performed) from Policy A and make them a member of the new policy you just created.
Deletion of the data from identified user/device
To delete the file(s) or folder(s) from the user’s backups using Parablu’s portal, user the following steps:
1. Login to the Parablu Portal
2. On the Parablu Portal home, go to the Search section at the top of the screen
3. Search for the user or device
4. Once on the User Account Details page, on the My Device tile, click on the menu and select File List
5. Browse through the backed-up files and folders and once the specific file/folder is located, right-click on it and select Delete from the context menu
6. Click Ok to complete the deletion process
Excluding the folders for future backups
Once the data is successfully deleted from the backup on Right To Be Forgotten requests, if required, you can also ensure that the backup from an identified folder or location is excluded in the future.
1. Login to the Parablu Portal
2. On the Parablu Portal home, go to the Policy Management tab
3. On the Policy Management page, click the Backup Policies option
4. Edit the policy you just created and moved the user to. On the General tab, under the Exclusion Folder Path, add the path to the identified folder – which you just “Administratively” deleted.
5. Click on Save to complete
6. Once saved, from the next backup onwards, the specified folder will be excluded from backing up
BluVault is replete with advanced features such as this one, designed to help enterprises achieve and remain regulatorily compliant. So, contact us to learn more and leverage our expertise for an effective data governance and compliance strategy.
