In the opening article of this blog series, we covered the importance of data sovereignty and how a sovereign Cloud can support data sovereignty and local laws and regulations. In this second article, we will look at the impact of data sovereignty regulations on data compliance, data security, and data privacy.
Data compliance and sovereignty
Data residency (the physical location of a server) is a central aspect of data sovereignty regulations. In many countries, data residency laws require organizations operating within a country to store data about residents on servers located within national borders. If our example company from the first part of this series, Rotterdam Runners, sells shoes to customers in Belgium and Germany, it means they must also store their data on Belgian and German servers. Consequently, these data residency laws pose a significant challenge for multinational companies that have employees and serve customers worldwide.
Data residency laws and regulations are constantly changing and vary from country to country. To remain compliant with the latest local data governance rules, multinational companies like Rotterdam Runners must regularly engage compliance specialists who are familiar with the legislation in the countries where they operate. And because this legislation can change in an instant, it is important that companies are flexible enough to hold their own in the current, heavily regulated, and volatile climate. Or, as one Fortune 500 CISO puts it: "A law can change, and that can completely change the way you do business."1
About 76% of multinational companies consider data compliance a major Cloud challenge.2 That sentiment is further fueled by the lack of competent and experienced personnel in the field of data compliance. Half of the participants in an ISACA study reported that they have experienced knowledge gaps regarding compliance regulations, as well as compliance frameworks and management environments. Another 46% indicated that they currently lack knowledge of privacy-related technology.3 To tackle these data compliance challenges, new strategies and tactics will need to be developed.
Data security and privacy
The comprehensive EU General Data Protection Regulation (GDPR) has inspired many countries to adopt similar data privacy rules. A key provision of the GDPR is the secure processing of personal data. The GDPR requires that security policies and procedures be in place to ensure the confidentiality, integrity, and availability of personal data.4
Robust data security procedures are crucial for processing your customers' personal data. A data breach can lead to identity theft, and data destruction can wipe out vital financial information and intellectual property. Limiting access to sensitive data is also a fundamental aspect of data security.
A sovereign Cloud can help your organization implement these strict data access restrictions. Because data in a sovereign Cloud complies with local data residency and sovereignty laws and regulations, it is protected from the prying eyes of foreign powers. Furthermore, the security of sovereign Clouds must be regularly audited using an information security management system (ISMS) and certified according to a recognized industry standard. In addition, sovereign Clouds are managed by experienced providers who are well-versed in the advanced security strategies and tactics needed to protect your applications and data against the constantly changing threats of ransomware and cyberattacks.
A common way to protect your business data is by applying micro-segmentation with zero-trust access. This shuts down communication between workloads unless it is explicitly permitted. Furthermore, a sovereign Cloud can apply encryption and even be air-gapped to keep external threats out. This layered security approach of a sovereign Cloud is the best way to protect your business data and applications against corruption, destruction, and loss.
In an attempt to meet the compliance, security, and privacy challenges of local data sovereignty rules, 81% of executives in highly regulated industries have moved all or some of their data and workloads out of the Public Cloud.5 Some of these organizations have switched to a hybrid Cloud approach, while others have moved their data back to their own on-premises servers. However, there is another solution to these challenges.
The Dutch sovereign Cloud from Fundaments is built on the VMware Sovereign Cloud Framework, and the team of Dutch compliance and digital security specialists can fill any internal knowledge and skill gaps in your organization. With Fundaments' sovereign Cloud, you can adapt rapidly to changing Dutch and EU data laws while your data is protected against sophisticated cyber threats.
This series consists of four blog articles: we will post a new one every week.
- CSO, Data residency laws pushing companies toward residency as a service, January 2022
- Flexera 2022 State of the Cloud Report
- ISACA, Privacy in Practice 2022, March 2022
- NetSec.news, GDPR Security Checklist, viewed August 2022
- IDC, commissioned by VMware, Deploying the Right Data to the right Cloud in Regulated Industries, June 2021
