Meeting GDPR Challenges with Delphix

Short Summary

GDPR takes effect on May 25, 2018 and applies worldwide to any organization that holds or processes personal data relating to EU residents. Its definitions are intentionally expansive: “personal data” includes any information that can identify a person directly or indirectly (including identifiers like location data and online identifiers), and “processing” covers virtually any operation across the full lifecycle of that data, from collection through deletion. Processing is only lawful if it meets strict criteria (such as explicit consent, contract necessity, legal obligation, vital interests, public interest, or legitimate interests), and data subjects gain extended rights to access, correct, erase their data, and withdraw consent. Enforcement is severe, with penalties up to the greater of 4% of annual worldwide turnover or 20 million euros for serious breaches, while the Data Controller bears the burden of implementing and demonstrating compliance.

A central risk highlighted is non-production use of personal data (development, testing, outsourcing, cloud uploads). Because GDPR’s definition of processing includes these activities, personal data can proliferate beyond direct organizational control while responsibility and liability remain with the Data Controller. This creates complex obligations: extending data subject rights (disclosure, rectification, erasure) to all copies, ensuring Article 28(3) contractual controls for third parties, expanding breach detection and notification processes, and performing impact assessments where appropriate.

The text proposes minimizing exposure by removing personal data where it is not required, using anonymization or GDPR-endorsed pseudonymisation as “data protection by design and default,” while acknowledging residual risk when reversibility exists. Delphix Dynamic Data Platform is presented as a way to discover sensitive data across sources, govern non-production distribution, and apply irreversible masking to anonymize data (removing it from GDPR scope) while preserving relational usefulness for development and testing; tokenization is available when reversibility is needed but remains within GDPR scope.

Interesting Facts

• GDPR becomes effective on May 25, 2018.
• GDPR applies to organizations worldwide that hold or process personal data relating to people resident in the European Union.
• Personal data includes information that can identify a person directly or indirectly, including identification numbers, location data, and online identifiers.
• Processing includes any operation performed on personal data, automated or not, spanning collection through final deletion.
• Lawful processing requires meeting at least one Article 6 condition, including explicit consent, contract necessity, legal obligation, vital interests, public interest, or legitimate interests.
• Data subjects have rights to access, correct, and erase their personal data and to withdraw consent.
• GDPR penalties include up to the greater of 4% of annual worldwide turnover or 20 million euros for serious breaches.
• The Data Controller is responsible for implementing compliance and demonstrating proof of compliance with GDPR principles.
• Anonymous information is outside GDPR scope, including personal data rendered anonymous such that the data subject is not identifiable.
• Delphix provides tokenization that keeps a record mapping replaced values, making tokenized data dependent on the security of the token database and not anonymized for GDPR purposes.

Notable Quotes

• “The definition of personal data is very wide ranging, and the definition of processing is also very broad.”
• “The data subject has rights to access, correct and erase their personal data as well as to withdraw consent to its use.”
• “If the Data Controller cannot demonstrate that the non-production use is fair and lawful, or even worse, if the organization is not even aware that the data is being used in this way, it may be subject to the sanctions defined in GDPR.”
• “If the Data Controller can justify that this non-production processing is fair and lawful then all the GDPR data protection requirements apply to that processing.”
• “A better alternative is to avoid the problem altogether using techniques to anonymize the personal data in non-production use.”
• “Pseudonymisation is encouraged as a way to implement data protection by design and default but there is a residual risk for the Data Controller who needs to manage this by the appropriate choice of tools.”
• “The Delphix Dynamic Data Platform supports the discovery of personal data.”
• “The Delphix Dynamic Data Platform can anonymize personal data and remove it from the scope of GDPR.”
• “The Delphix Dynamic Data Platform governs and controls the distribution of non-production data.”
• “The Delphix Dynamic Data Platform can reduce the costs and risks associated with the use of personal data for non-production purposes when GDPR comes into force.”