Guidelines for GDPR readiness

Protecting your data can help you comply with the General Data Protection Regulation (GDPR). GDPR establishes a regulatory framework for processing personal data.

Note:

Use the following sections to help you prepare for GDPR readiness. Each section provides information about the features of IBM Business Automation Insights that you can configure to help your organization with GDPR readiness. The information is not an exhaustive list, due to the many ways that features can be configured, and the large variety of ways that the products and containers can be used.

When you install and use IBM Business Automation Insights, you are responsible for ensuring that it is compliant with various laws and regulations, including the GDPR adopted by the European Union in May 2018. Obtain the advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulations that might affect your business. Take the resulting actions to comply with such laws and regulations.

IBM® does not provide legal, accounting, or auditing advice, or represent or warrant that its services and products ensure compliance with any law or regulation. The responsibility to ensure that an IBM product is compliant with laws and regulations is on the company that purchases the product. Always consider how protected your data is and whether it is ready for GDPR. For more information, see the GDPR External link opens a new window or tab page on the IBM website.

You can use the following information to protect your data and comply with the GDPR.

IBM Business Automation Insights configuration

IBM Business Automation Insights is used to gain business insight from the various applications by managing the emitted events and processing the data in IBM Business Automation Insights. The included on-premises products are listed in IBM Documentation, and the product documentation provides relevant GDPR deployment information.

As the IBM Business Automation Insights is shared by users in different roles (developers, testers, analysts, and data scientists), it introduces a challenge of provisioning access and authorization to the cluster and securing the data.

IBM Business Automation Insights is an amalgamation of several components that are still evolving and expose their own security policies for data and access protection.

Security architecture

Business Automation Insights is built on Kubernetes and other open source technologies. The security and data privacy protection is to be considered in the entirety of the stack.
  • All the secret information or credentials are managed by Kubernetes secrets, see the Secrets External link opens a new window or tab page of the Kubernetes documentation. Some credentials are stored in configuration files, which must be protected. For more information, see the Configuring cluster security External link opens a new window or tab page of the Business Automation Insights documentation.
  • The security model relies on the cloud provider.

Business Automation Insights also uses a number of IBM and open source components. If a component is found to have a vulnerability, the product team assesses the impact and might provide intermediate fixes based on the IBM PSIRT process.

The following diagram shows the security architecture of Business Automation Insights.

Diagram security architecture

OpenShift® Cloud Platform TLS configuration and egress configuration

For more information, see Configuring cluster security External link opens a new window or tab.

Event emitters

Each platform product configures its emitter of events to Business Automation Insights.
  • The BPM event emitter (bpmn and bawadv jobs) selects data per field to be part of the event. You can choose the fields according to your needs and to data sensitivity.
  • The Case event emitter provides data from Case events. Filtering can be done at case solution level. Users can choose which solution events to process. All the events for that particular solution are processed.
  • The Operational Decision Manager processing application enables precise filtering of fields and anonymization functions.
  • The Content event emitter captures Content events so that Kafka can process document metadata.
The event emitters send events to the Kafka provider through Apache Kafka protocols. The security of streams of events is a critical aspect for data protection. To increase levels of security, Cloud Pak provides:
  • encryption of data that transit between the emitters and the Kafka brokers.
  • authentication of client emitters.
  • authorization of client emitters.

For more information about the security of streams of events, see Securing communications from event emitters to Kafka.

Event processing

Business Automation Insights is subscribed to the event topics and receives the event streams. The events are ingested and processed according to the processor.

When events are processed, Business Automation Insights produces intermediary results that are stored locally on the disk.

Disk encryption can be implemented at the file system level. Linux® Unified Key Setup (LUKS) is one technology that you can use for encryption. Any temporary state is encrypted with AES (128 bits) and an internal key.

Security and rules for data protection

In general, data that is used for authentication must be in a directory service or LDAP. Databases are provisioned during installation. Make sure to maintain them throughout product lifecycles.
Basic recommendations
  • Regularly back up data, according to your business needs and to the risk level.
  • Encrypt data backups.
  • When data is no longer used, delete the databases or archive them for future use.
  • As a data controller, provide means to satisfy data access requests for personal information or other compliance requests.
Further considerations
  • Make sure that control of access to databases is in place and effective.
  • Use strong credentials.
  • Protect the REST administration APIs with proper credentials.
  • Use HTTPS or equivalent secure communication protocols for all the connections.
  • Remove or change all default passwords.
  • If your business application is accessible from the internet, consider Securing business application data External link opens a new window or tab.

Secrets

IT administrators are responsible for the configuration and the security of the cloud cluster. In particular, an administrator is the person to provide and manage the secrets that are used for all of the deployments. In IBM Business Automation Insights, the container images do not include any secrets. Before deployment, the administrator must review the content of the custom resource file and provide all the Kubernetes secrets that are needed for the deployment.

Typically, secrets are needed for user credentials, passwords, certificates, encryption keys, API keys, tokens, and other code. After the secrets are created, the containers can be installed. The administrator must take note of these secrets, store them in a safe place like a password manager or encrypted files, and then manage them with the proper attention.

Data access

OpenSearch

OpenSearch is used by Business Automation Insights. Data in OpenSearch does not use anonymization rules and is therefore stored in clear text. If you have sensitive data in Business Automation Insights, consider removing the corresponding fields from the event emitter so that no sensitive data gets stored in OpenSearch.

Data deletion

Article 17 of the GDPR states that data subjects have the right to request that their personal data be removed from the systems of controllers and processors, without undue delay. Implement appropriate controls and tools to satisfy this right.

IBM Business Automation Insights does not require any special method for data deletion, providing that it is secure.

Data that reflects personally identifiable information (PII) can be in all stages of the data processing pipeline. Data deletion must include all these stages.

Business Automation Workflow, Workflow Process Service, and Business Automation Studio persist some basic user data in the product database, for example, the username associated with access control lists. See GDPR-related administrative tasks External link opens a new window or tab in the Business Automation Workflow documentation for information about the APIs available to obfuscate this data.

Responding to requests from individuals

The personal data that is stored and processed by IBM Business Automation Insights falls into one or more of the following categories.
  • Basic personal data, such as names, usernames, and passwords.
  • Technically identifiable personal information, such as IP addresses and hostnames to which user activity might potentially be linked.
  • Personal data that might be stored in text.
This data is key for efficient operation of an automated system. Consider and implement secure and lawful responses to the following requests.
  • Delete data.
  • Correct data.
  • Modify data.
  • Extract specific data for export to another system.
  • Restrict the use of data within the overall system.