Audits and Compliance: Data Locality, PCI DSS, and GDPR

Vocabulary flashcards covering key concepts from the notes on data locality, PCI DSS, GDPR, and audits/compliance.

Data locality

Geographic location where data is stored and processed; drives regulatory requirements and latency considerations.

Data sovereignty

Legal requirement that data generated within a country remains within its borders or subject to that country's laws.

PCI DSS

Payment Card Industry Data Security Standard; contractual requirement (not a law) for entities that accept, process, store, or transmit cardholder data.

Cardholder Data Environment (CDE)

Part of the network that stores, processes, or transmits cardholder data; requires segmentation and strong controls.

GDPR

General Data Protection Regulation; EU regulation focusing on data protection and privacy; applies to EU/EEA entities and to non-EU organizations serving EU residents.

Data subject rights

Rights under GDPR including the right to be informed, access, rectification, erasure, and restriction of processing.

Data protection principles

GDPR principles such as data minimization, accuracy, storage limitation, integrity, and confidentiality.

Data Protection Impact Assessment (DPIA)

GDPR-required assessment to identify and mitigate privacy risks of processing operations.

Data Protection Officer (DPO)

Individual appointed to oversee data protection strategy and GDPR compliance.

Data breach response plan

Plan to detect, respond to, and recover from data breaches; essential for GDPR and PCI DSS compliance.

Continuous monitoring and auditing

Ongoing program to monitor data flows and access; includes regular audits for standards like PCI DSS and GDPR.

Risk assessment / risk management

Process to identify, assess, and mitigate legal/compliance risks from data storage/transfer based on data location.

Latency and data proximity

Storing data close to end users to reduce latency and improve performance; may influence cloud region choice.

Policies and incident response

Written policies for data handling, access control, and incident response enforced across the organization.