Compliance Beyond Security: a Cloud Native GDPR Implementation Experience
summary
GDPR forces data minimization and the right to be forgotten, not just encryption, and recent rulings (Privacy Shield invalidation; a French court on backups) complicate transfers to non‑EU clouds. The practical solution shown is an open‑source “Compliant Kubernetes” stack that combines Kubernetes with Dex/OpenID Connect, RBAC and OPA Gatekeeper for identity and policy, Falco plus Elasticsearch/Kibana for breach detection and audit, and strict retention/backup workflows; recommendation is to run sensitive workloads on EU/on‑prem providers or use standard contractual clauses.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:58Thought experiment
- 3:04Privacy is an international trend
- 3:56What is personal data?
- 8:36Data obsolescence challenge
- 13:05Why care about data transfers?
- 15:48Data transfers, what are my options?
- 17:21Solution: Cloud agnostic compliance
- 18:31How to use Cloud Native in a GDPR compliant way?
- 19:03Technical GDPR articles
- 21:38Example bundling: Compliant Kubernetes
related talks
39mdev.privacy: GDPR in a nutshell
49mCloud Security Made for the EU: Securing Data & Applications
48mPreparing for the New Privacy Shield with Privacy and Data Sovereignty in the Cloud
26mGetting Real about Protecting Privacy and Data Flows across Borders
01h 59mDeep Dive Workshop – Data Security and Data Protection
01h 59mDeep Dive Workshop – Data Security and Data Protection
48mBuilding GDPR, ISO27001 Containerized Application for continuous compliance
35mInvestigation: Data Platforms on European Cloud Providers