Satisfy EU GDPR Data Protection
Requirements with DataSecurity Plus

Article 5(1)(c)

Personal data should be adequate, relevant, and limited to what is necessary.

Article 5(1)(f)

Personal data should be protected against accidental loss, destruction, or damage.

To help maintain data integrity:

1. Audits file and folder actions including create, rename, delete, copy, and more, in real time.
2. Triggers instant email alerts to admins about monitoring suspicious file actions, such as excessive permission changes, renames, etc.
3. Tracks failed attempts to access your critical data.
4. Maintains a foolproof audit trail of all file accesses to aid forensic investigations.

To help maintain data security:

1. Detects and contains potential ransomware infections instantly to prevent devastating data loss.
2. Detects and prevents the leakage of business-critical files via USB devices, or as an email attachment.

Article 15(1)

The data subject has the right to request what information about them is being processed.

Article 15(3)

The controller shall provide a copy of the data undergoing processing.

Article 16

The data subject can request the controller to rectify inaccurate information concerning him/her.

Article 17(1)

In compliance with guidelines mentioned in the law, the data subject has the right to request the controller to erase all information concerning him/her.

Article 24(2)

Appropriate data protection policies are to be implemented to protect the rights of data subjects.

1. Uses predefined policies to help prevent unwarranted data transfers to USB devices, monitor file integrity, and more.
2. Uses automated threat response mechanisms to shut down infected systems, disconnect rogue user sessions, and more.

Article 25(2)

Practice data minimization and ensure that personal data is not accessible by an indefinite number of individuals.

1. Find users with full control access to your Windows shares.
2. Locate all the files and folders that have been shared with everyone.

Article 30(1)

A record of all processing activities along with details on the sensitive data processed and the technical measures used to safeguard the data shall be maintained.

1. Locates instances of personal/sensitive personal data stored across Windows file servers and failover clusters utilizing a dedicated GDPR data discovery policy.
2. Scans for national identification numbers, credit card details, license number, and more.
3. Finds who has what permission over files containing sensitive personal data.
4. Audits user activity in files with details on who accessed what, when, and from where.

Article 32(2)

Technical and organizational measures to address the risk in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted or stored shall be implemented.

To address the risk of potential data leaks:

1. Monitors the use of removable storage devices such as USBs in your organization.
2. Blocks the movement of files containing personal data to USB devices, or via email as attachments.
3. Provides contextual warnings using system prompts about the risk of moving business-critical data to removable storage devices, or via email as attachments.
4. Reduces incident response times with instant alerts, and an automated threat response mechanism.

To address the risk of unauthorized accesses or disclosure:

1. Alerts and reports on unwarranted accesses, or sudden spikes in file accesses and modifications, including permission changes, deletions, and more.
2. Spots files with security vulnerabilities such as:
   • Files owned by stale users.
   • Critical files that allow full control access to users.
   • Overexposed files, or files accessible by everyone.
3. Tracks sudden spikes in failed attempts to access your files/folders.
4. Reviews access rights and file permissions periodically.

To address the risk of accidental or unlawful destruction:

1. Maintains a complete record of all file and folder deletions, along with details on who deleted what, when, and where.
2. Uncovers and quarantines possible ransomware infections.

Article 33(3)

In case of a personal data breach, the notification should include measures taken to address and mitigate the possible adverse effects of the personal data breach.

Article 35(7)(d)

A data protection impact assessment should include measures envisaged to address risks including safeguards and safety measures to ensure the protection of personal data.

1. Calculate the risk score of files containing personal/sensitive personal data by analyzing their permissions, volume and type of rules violated, audit details, and more.
2. Identify files that are vulnerable due to permission hygiene issues.