登录查看更多内容

How can you maintain data privacy when retiring old systems?

由人工智能和领英社区提供技术支持

Data privacy is a crucial aspect of information systems, especially when it comes to retiring old systems that may contain sensitive or personal information. If you are responsible for decommissioning or disposing of old systems, you need to ensure that you follow the best practices and legal requirements to protect the data privacy of your customers, employees, and stakeholders. In this article, we will discuss how you can maintain data privacy when retiring old systems, and what steps you need to take before, during, and after the process.

此文章中的业界达人

由社区从 8 条内容中精选。了解更多

Srikant Das

Analytics Specialist SA | Europe North | AWS Speaker
José Carlos Teixeira

Invited Assistant Professor at NOVA IMS Information Management School | Data Governance and GDPR Consultant | Guest…
Diogo Duarte

LL.M., CIPP/E, CIPM, FIP, ECPC-G | Privacy Counsel | Data Protection Officer | GDPR Compliance Specialist

1 Assess the risks

Before you retire an old system, you need to assess the risks involved in the data privacy aspects of the system. You need to identify what kind of data the system holds, how sensitive or confidential it is, who has access to it, and what are the potential threats or vulnerabilities that could compromise it. You also need to consider the legal and regulatory obligations that apply to the data, such as the GDPR, the HIPAA, or the CCPA. Based on your risk assessment, you need to determine the level of data protection and security that you need to apply to the system, and the appropriate methods and tools that you need to use to retire it.

添加您的观点

José Carlos Teixeira

Invited Assistant Professor at NOVA IMS Information Management School | Data Governance and GDPR Consultant | Guest Lecturer at IPAM | DAMA Portugal Board Member
举报内容
When retiring old systems, i assume that the personal data has already been deleted (or anonimized) in accordance with Article 5 of the GDPR. If this has not happened yet, we have a problem with GDPR compliance.

已翻译

赞
Diogo Duarte

LL.M., CIPP/E, CIPM, FIP, ECPC-G | Privacy Counsel | Data Protection Officer | GDPR Compliance Specialist
举报内容
In retiring old systems containing personal data, it's vital to assess the type and volume of data retained. Despite these systems being inactive, the data within them demands ongoing protection. This is critical because, under regulations like the GDPR, mere storage qualifies as data processing, triggering legal obligations. Therefore, organizations must implement protective measures such as access restrictions, password-protected files, encryption, and anonymization. Additional steps might involve regular security audits, data minimization strategies, and secure data destruction protocols.

已翻译

赞
Nitin Somkuwar

Tech Lead - Salesforce Certified
举报内容
-here are the few steps for data privacy during sunset the app. 1. Data backup -ensure that u have a copy of data 2 . Data migration -if data needs to be migrated from legacy system use secure encrypted connections. 3 .Encryption of data - Ensure all the the data is encrypted and make sure decrypt the data before migrating 4.Hard delete the customer data 5. Communications with respective stockholders and customer regarding data retirement process 6. Periodic audits -periodic audits neeta to be happen during the retirement process and make sure no more data left behind .

已翻译

赞
Fábio R.
举报内容
Maintaining data privacy during system retirement is critical. Here are key steps: -Inventory and Assess: Identify sensitive data. -Minimize Data: Migrate only necessary data. -Secure Transfer: Encrypt data during migration. -Sanitize or Destroy: Wipe or destroy old data securely. -Review Contracts: Fulfill any privacy obligations. -Notify and Obtain Consent: Inform stakeholders and get consent if needed. -Monitor and Audit: Track the process and conduct regular audits.

已翻译

赞

2 Plan the process

After you have assessed the risks, you need to plan the process of retiring the old system. This should include defining the scope, objectives, and timeline of the process, as well as assigning roles and responsibilities to the people involved. Additionally, you should document policies and procedures to ensure data privacy and compliance. When it comes to planning, some key aspects include backing up or migrating data from the old system to a new system or secure storage location, erasing or destroying data using techniques such as encryption or overwriting, verifying that data has been successfully erased or destroyed with tools such as audit logs or checksums, and disposing of or recycling the old system and its components in an environmentally responsible way.

添加您的观点

Jessica Olson

SQL Developer at Allianz Technology
举报内容
In my experience, planning the process of data cleansing, migration, and time frame, can take longer then the actual process. Some industries require a backup of the data for many years, so you may not be able to anonymize the data as much as you wanted. Determining what kind of storage is needed for that data will also help on privacy. Limiting the access to backups and old system data is where the privacy needs to start. You can use cloud storage, for instance Glacier Deep Archive, and only give access to certain roles that can retrieve the data.

已翻译

赞
Wilson Coghi Júnior

Power BI - Analista de Business Intelligence. Desenvolvedor de painéis dinamicos e interativos. Criador de vis?es estratégicas, storytellig e análise de dados.
举报内容
Quem trabalha com tecnologia sabe que tudo muda com uma frequência absurda, e, com isso temos que nos adaptar as novas mudan?as, novas ferramentas e sistemas. Desta forma é necessário aposentar de forma segura tudo que foi utilizado. Muito importante realizar documenta??o do que foi realizado, dos backups, das transferências, das substitui??es, entre outros. Seguir as políticas da sua organiza??o é a maneira correta, pois lá est?o descritas melhor forma de armazenar e criptografar seus dados, onde todos os riscos foram mapeados e todas as etapas foram planejadas. Lembre-se que os dados s?o ativos bem importantes do seu negócio, n?o podendo ser deixados expostos.

已翻译

赞

3 Communicate the process

Before you start the process of retiring the old system, you need to communicate the process to the relevant stakeholders, such as the data owners, the data subjects, the data processors, and the data protection authorities. You need to inform them about the reasons, benefits, and risks of retiring the old system, and how you will protect their data privacy rights and interests during and after the process. You also need to obtain their consent, approval, or authorization, if required by law or contract. You need to maintain a transparent and consistent communication with the stakeholders throughout the process, and address any questions or concerns that they may have.

添加您的观点

Srikant Das

Analytics Specialist SA | Europe North | AWS Speaker
举报内容
Before retiring an old system, Identify the data types, data sensitivity, data access, and compliance regulations ( like GDPR, CCPA etc.) Followed by defining a scope and objectives with timelines. Also, consider data backup/migration, security and data encryption. As a final step before execution, inform all the relevant stakeholders about reasons, risks and benefits.

已翻译

赞

4 Execute the process

Once you have communicated the process, you need to execute the process according to your plan. You need to follow the policies and procedures that you have documented, and use the methods and tools that you have selected. You need to ensure that you comply with the data privacy and security standards and regulations that apply to your system and data. You also need to monitor and record the process, and report any issues or incidents that may occur. You need to verify that the process has been completed successfully, and that the data has been erased or destroyed from the old system.

添加您的观点

5 Review the process

After you have executed the process, you need to review the process and evaluate its outcomes. You need to analyze the data and feedback that you have collected during the process, and measure the performance and effectiveness of the process. You need to identify the strengths and weaknesses of the process, and the lessons learned and best practices that you can apply to future processes. You also need to update your documentation and records, and archive or dispose of them securely. You need to communicate the results and findings of the process to the stakeholders, and acknowledge their contributions and feedback.

添加您的观点

6 Maintain the process

Finally, you need to maintain the process and ensure its sustainability and improvement. You need to keep track of the changes and updates that may affect your system and data, such as new technologies, regulations, or business needs. You need to review and update your policies and procedures, and train and educate your staff and partners on data privacy and security issues. You also need to audit and test your system and data regularly, and implement corrective and preventive actions if needed. You need to foster a culture of data privacy and responsibility in your organization, and engage with your stakeholders and customers on data privacy matters.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Ming San Hu
举报内容
When shutting down old applications, one of the main risks is "forgetting" data within physically located server partitions rather than in the cloud. From personal experience in the field, I have often come across the presence of copies of data, for back-up purposes in terms of restoring, rather than copies kept for protection purposes in eventual court litigation. The most important thing in these cases is "prevention," which means having done proper data mapping and having implemented automated deletion procedures. Otherwise, the risk is not deleting the data, keeping it longer than the timeframe provided for legal purposes and incurring heavy penalties, such as provided for in the GDPR in the case of processing personal data.

已翻译

赞

Information Systems

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How can you maintain data privacy when retiring old systems?

1

2

3

4

5

6

7

1 Assess the risks

2 Plan the process

3 Communicate the process

4 Execute the process

5 Review the process

6 Maintain the process

7 Here’s what else to consider

Information Systems

给文章评分

感谢您的反馈

更多Information Systems相关文章

更多相关阅读内容

How can you maintain data privacy when retiring old systems?

1

2

3

4

5

6

7

1 Assess the risks

2 Plan the process

3 Communicate the process

4 Execute the process

5 Review the process

6 Maintain the process

7 Here’s what else to consider

Information Systems

给文章评分

感谢您的反馈

查看其他技能