GDPR Compliance

GDPR requirements, cloud enforcement via Cloud Custodian, and control coverage mapping.

GDPR (General Data Protection Regulation) is a European Union data protection law governing how personal data of EU individuals is collected, processed, stored, transferred, and deleted. It applies to any organisation processing EU residents' personal data, regardless of where the organisation is based.

Core Requirements

A. Lawfulness & Transparency

Lawful basis for processing (consent, contract, legal obligation, etc.)
Privacy notices and transparency to data subjects.

B. Data Subject Rights

Right to access their data.
Right to rectification.
Right to erasure (Right to be Forgotten).
Right to data portability.

C. Security & Protection (Article 32)

Appropriate technical and organisational measures.
Encryption and access control.
Ongoing confidentiality, integrity, and availability.

D. Accountability & Governance

Records of processing activities (RoPA).
Data Protection Impact Assessments (DPIA).
Breach notification within 72 hours.

GDPR compliance combines legal, technical, and organisational controls. Tooling covers only the technical layer.

Cloud Custodian enforces GDPR technical safeguards — security, exposure prevention, and data lifecycle controls.

GDPR Control Area	Covered	Description
Encryption at rest	✅ Cloud Custodian	S3, EBS, RDS encryption enforcement
Encryption in transit	✅ Cloud Custodian	TLS / HTTPS enforcement
Access control	✅ Cloud Custodian	IAM hygiene, least privilege, MFA
Exposure prevention	✅ Cloud Custodian	Public storage and network detection
Logging & auditability	✅ Cloud Custodian	CloudTrail configuration checks
Data retention enforcement	✅ Cloud Custodian	Resource lifecycle cleanup
Region / data residency	✅ Cloud Custodian	Enforce approved regions

Sample Cloud Custodian Policies

Enforce Encryption on Personal Data Storage

policies:
  - name: gdpr-s3-encryption-required
    resource: s3
    filters:
      - type: bucket-encryption
        state: false

Prevent Public Access to Personal Data

policies:
  - name: gdpr-no-public-s3
    resource: s3
    filters:
      - type: global-grants
        operator: not-equal
        value: []

Enforce Approved Regions Only

policies:
  - name: gdpr-approved-regions-only
    resource: aws.account
    filters:
      - type: region
        op: not-in
        value: [eu-west-1, eu-central-1]

Full Controls Coverage

GDPR Control / Requirement	Tool Coverage	Notes
Encryption at rest	Cloud Custodian	Enforces cloud-side encryption
Encryption in transit	Cloud Custodian	TLS / HTTPS enforcement
IAM least privilege	Cloud Custodian	Role and policy hygiene
MFA for users	Cloud Custodian	IAM credential checks
Public cloud resources	Cloud Custodian	Prevents accidental data exposure
Data residency / approved regions	Cloud Custodian	Region guardrails
Cloud audit logging	Cloud Custodian	CloudTrail configuration
Log integrity	❌	Requires secure storage + governance
OS & application logs	Wazuh	Host-based logging
File integrity monitoring	Wazuh	Detects unauthorised file changes
Malware detection	Wazuh	Host-based malware detection
Intrusion detection	Wazuh	Runtime behaviour monitoring
Vulnerability scanning	Wazuh	CVE detection on hosts
Incident investigation evidence	Wazuh	Alerts, timelines
Data retention enforcement	Cloud Custodian	Resource lifecycle cleanup
Consent management	❌	Application & legal workflow
Data subject access requests (DSAR)	❌	Application-level process
Right to erasure (RTBF)	❌	Requires app + database logic
DPIA / risk assessment documentation	❌	Governance & legal process
Breach notification (72-hour rule)	❌	Legal & operational workflow
Privacy notices & transparency	❌	Legal documentation

GDPR Compliance

On this page