Platform considerations for GDPR readiness

Notice

This document is intended to help you in preparing for GDPR readiness. It provides information about Instana features that you can configure and aspects of the product's use that you should consider to help your organization with GDPR readiness. This information is not an exhaustive list, and the large variety of ways that the product can be used in itself and with third-party applications and systems.

Clients are responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation. Clients are solely responsible for obtaining advice of competent legal counsel regarding the identification and interpretation of any relevant laws and regulations that may affect the clients' business and any actions the clients may need to take to comply with such laws and regulations.

The products, services, and other capabilities described may not be suitable for all client situations and could have limited availability. IBM® does not provide legal, accounting, or auditing advice or represent or guarantee that its services or products will ensure that clients are in compliance with any law or regulation.

Table of Contents

• GDPR
• Product Configuration for GDPR
• Data Life Cycle
• Data Collection
• Data Storage
• Data Access
• Data Processing
• Data Deletion
• Data Monitoring
• Capability for Restricting Use of Personal Data

GDPR

The General Data Protection Regulation (GDPR) has been adopted by the European Union (EU) and has been in effect since May 25, 2018.

Product configuration - considerations for GDPR readiness

The following sections describe aspects of data management within Instana and provide information on capabilities to help customers with GDPR requirements.

Data lifecycle

Instana is designed to help IT operations teams, development teams, and DevOps teams operate more efficiently. To ensure the operation of the software that they develop, modern teams need advanced application performance monitoring and observability capabilities.

Instana deals primarily with technical data, some of which might be subject to GDPR. Additionally, Instana deals with information about users who manage the deployment. This data is described throughout this document for the awareness of customers responsible for meeting GDPR requirements. This data is persisted on local or remote file systems as configuration files or within databases. Applications integrated with Instana might deal with other forms of personal data subject to GDPR. The mechanisms that are used to protect and manage data are also available to applications that integrate with Instana. Additional mechanisms might be necessary to manage and protect personal data collected by these applications.

To best understand Instana and its data flows, you must understand how Kubernetes and Docker work. These open source components are fundamental to Instana.

Instana includes a catalog of containerized software and services from Instana in the default Instana repository list. To view a list of all the Instana charts, see IBM/charts. For considerations about GDPR for the products listed in the catalog, refer to the documentation for those products. Some of the applications available in the catalog are open source software. It is the customer’s responsibility to determine and implement any appropriate GDPR controls for open source software. Information about these packages is included in the catalog entry.

Data collection

Instana does not collect any special categories of personal data. However, it does create and manage technical data such as administrator user IDs and passwords, service user IDs and passwords, IP addresses, and Kubernetes node names, that might be considered personal data. Instana also deals with information about users who manage the offering. All such information is only accessible by the administrator.

The Instana agent supports the specification of patterns for secrets, which means that data can be redacted agent-side from the tracing data. Data that are treated as secrets do not reach the Instana SaaS for processing and, thus, are not available for analysis in the product console or retrieval by APIs. For more information, see Secrets.

Applications that run on Instana might collect personal data.

When you assess the use of Instana running containerized applications and your need to meet the requirements of GDPR, you must consider the types of personal data that is collected by the application and aspects of how that data is managed, such as:

• How is the data protected as it flows to and from the application? Is the data encrypted in transit?
• How is the data stored by the application? Is the data encrypted at rest?
• How are credentials, which are used to access the application, collected and stored?
• How are credentials, which are used by the application to access data sources, collected and stored?
• How is data collected by the application removed as needed?

This list is not a definitive list of the types of data that is collected by Instana. It is provided as an example for consideration. If you have any questions about the types of data, contact IBM.

Data storage

Instana persists technical data in stateful stores on local or remote file systems as configuration files or in databases. Consideration must be given to securing all data at rest. Instana supports encryption of data at rest in stateful stores.

Data access

Instana provides several groups and roles for controlling data access. The groups and roles enable differentiation between normal users and users with extra privileges.

Data processing

In general, data used for authentication must be in a directory service or LDAP. Databases are provisioned during installation. Make sure to maintain them throughout the product lifecycles.

Basic recommendations

• Regularly back up data, according to your business needs and to the risk level.
• Encrypt data backups.
• When data is no longer used, delete the databases or archive them for future use.
• As a data controller, provide means to satisfy data access requests for personal information or other compliance requests.

Further considerations

• Make sure that control of access to databases is in place and effective.
• Use strong credentials.
• Protect the REST administration APIs with proper credentials.
• Use HTTPS or equivalent secure communication protocols for all the connections.
• Remove or change all default passwords.

Data deletion

Article 17 of the GDPR states that data subjects have the right to request the removal of their personal data from the systems of controllers and processors, without undue delay. Implement appropriate controls and tools to satisfy this right.

Instana does not require any special method for data deletion.

Data that reflects Personally Identifiable Information (PII) can be in all stages of the data processing pipeline. Data deletion must include all these stages. Administrators can use Instana features to remove user data.

Data monitoring

Regularly test, assess, and evaluate the effectiveness of your technical and organizational measures to comply with GDPR. These measures should include ongoing privacy assessments, threat modeling, centralized security logging, and monitoring, among others.

Capability for restricting use of personal data

Using the facilities summarized in this document, Instana enables users to restrict the usage of any technical data that is considered personal data.

Under GDPR, users have rights to access, modify, and restrict processing. Refer to other sections of this document to manage the following controls:

• Right to access
  • Administrators can use Instana features to provide individuals access to their data.
  • Administrators can use Instana features to provide individuals with information about the data that the Instana platform uses about the individual.
• Right to modify
  • Administrators can use Instana features to allow an individual to modify or correct their data.
  • Administrators can use Instana features to correct an individual's data for them.
• Right to restrict processing
  • Administrators can use Instana features to stop processing an individual's data.