GDPRValidator: a tool to enable companies using cloud services to be GDPR compliant

Introduction

Today, it is truer than ever to state that technology cannot achieve its full potential without user trust, and establishing strong data protection measures is key to building trust. Furthermore, due to the development of technologies based on distributed storage and processing, such as cloud computing, it has become more difficult to control, monitor, and safeguard the personal data handled by these types of infrastructure, making data breaches more likely. For this technology to achieve its full potential and deliver maximum benefit, it must provide a transparent and auditable environment. Data protection is therefore essential in achieving this goal. Migration of IT workloads to the cloud is associated with security risks and responsibilities. For this reason, organizations are establishing security and compliance governance procedures to manage their security duties in the cloud.

As of 2022, over 60% of all corporate data will be stored in the cloud, according to Statista (Statista, 2022). It reached 30% in 2015 and has continued to rise as companies move their resources to the cloud. Therefore, the aim is to improve security and reliability while advancing business agility. Thus, the main success factor for organizations in their cloud operations is to balance cloud benefits and security tasks. Cloud security requires a combination of legal, technical, operational, and governance measures, and effective cloud security governance requires policies, procedures, and processes. In this context, the European Union (EU) adopted the General Data Protection Regulation (GDPR) (GDPR, 2016) in 2016. GDPR replaces a Data Protection Directive from 1995, which was adopted when the Internet was relatively young. European Union countries must adapt their national laws to enforce the GDPR, but there have been many problems in this process, for instance, the lack of staff trained in GDPR (GDPR, 2020b). In June 2020, the European Commission published its first report on the evaluation and review of the GDPR (GDPR, 2020a). This report comes two years after the regulation became applicable on 25 May 2018. As stipulated by GDPR article 97 (GDPR.EU, 2018), it particularly assesses the following issues: (1) the application and functioning of the rules on the transfer of personal data to third countries and international organizations; (2) the application and functioning of the rules on cooperation and consistency; and finally, (3) the issues raised over the past two years by various actors.

Articles 24 and 25 of the GDPR introduce the figure of the data controller. This controller is responsible for implementing technical and organizational measures to ensure and demonstrate that data processing complies with the regulation, and these measures can be reviewed and updated when necessary. Furthermore, GDPR articles 37, 38, and 39 define the role and position of the Data Protection Officer (DPO) (GDPR.EU, 2022c). The DPO is responsible for overseeing an organization’s data protection strategy and implementation. However, a DPO only needs to be appointed when certain conditions are met, according to GDPR article 37. Generally, these conditions arise when a company’s activity requires large-scale data processing or when the processed data is sensitive or belongs to special categories, according to articles 9 and 10 of GDPR. Nevertheless, it is recommended that small and medium enterprises (SMEs) that plan to enter international markets hire a DPO (ComplianceJunction, 2018) to assist in the expansion process. The expense of hiring a full-time DPO (GDPR.EU, 2022c) may not be feasible for SMEs, but the DPO can be hired or shared by several SMEs in such cases.

In this article, we propose the GDPRValidator tool to help SMEs in assessing their GDPR compliance. Its purpose is to make compliance with GDPR easier for data controllers and to simplify the work of DPOs. Thus, the main motivation is to assist them to be more competitive since by using GDPRValidator these companies can learn and begin the GDPR compliance process by themselves, better understand the regulation and improve their data management strategies.

Contributions

The main contribution of this article is the presentation of a tool to help SMEs understand and validate their compliance with GDPR. Specifically, this contribution encompasses the following notable sub-contributions. (1) We have developed the GDPRValidator tool to assist SMEs in achieving “the principle of accountability”, under article 5² , which requires that companies take responsibility for how personal data is processed. In addition, this principle requires companies to demonstrate GDPR compliance by documenting their procedures and routines. (2) This tool can make companies aware of the importance of “privacy-by-design”, according to article 25. This GDPR article indicates that the controller has to implement technical and organizational measures both at the moment of determining the means of processing and during the actual processing. If companies do not comply with this principle, the work they have to do later to comply with GDPR can become overwhelming. (3) GDPRValidator enables economic savings for SMEs by helping them to audit and monitor their data activities with low cost. Furthermore, companies that process personal data on a large scale as part of their core business must engage a data protection officer (DPO). The DPO is responsible for monitoring GDPR compliance as part of the organizational measures referred to in article 25, as well as training staff in compliance and conducting audits. DPOs can also benefit from it. (4) The GDPRValidator tool provides recommendations about how SMEs can track their customers’ data to control the third parties that have accessed the data at a given moment.

The rest of the article is structured as follows (see Fig. 1 for the paper road map). The background is presented in “The general data protection regulation (GDPR)”, and “Related work” reviews related works. The methodology that the tool supports is described in “Methodology”, while “GDPR compliance validation” is devoted to the GDPR compliance process. Details of the implementation of our tool are described in “GDPRValidator”, and its validation is presented in “Validation”. Finally, “Conclusions” contains our conclusions and some lines for future research.

The general data protection regulation (gdpr)

The General Data Protection Regulation (GDPR) (GDPR, 2016) came into effect on May 25, 2018, to harmonize data protection laws across all EU member states. GDPR was adopted in 2016 to replace the Data Protection Directive, which was introduced in 1995 to align data protection standards in the EU, making internal and cross-border data transfers easier. GDPR not only harmonizes data protection rules but also creates legal certainty and removes possible barriers to the free flow of personal data, raising the level of privacy. This law governs the automatic processing of personal data (or sets of personal data) by anyone who processes or controls them.

GDPR divides the actors into three groups: data subjects, the people whose data is handled (for example, customers or site visitors); controllers, who determine the purposes and means of data processing; and processors, who process personal data on behalf of the controller. Everyone, including minors, is protected by GDPR. Furthermore, it applies to the processing of personal data of EU residents both inside and outside of the EU.

A company that handles the data of EU citizens must demonstrate compliance with GDPR and take the necessary technical and organizational measures to protect the data. GDPR establishes a purpose limitation, which ensures that personal data is collected for specific, explicit, and legitimate purposes.

Additionally, it includes a system engineering approach, called privacy-by-design. This approach is based on six fundamental principles that aim to integrate data protection into the design of new products and systems. Specifically, these principles are (Langheinrich, 2001; Cavoukian, 2009): (i) proactive and preventive, not reactive; (ii) privacy as default settings; (iii) privacy built into the design; (iv) full functionality—positive-sum, not zero-sum; (v) end-to-end security—full lifecycle protection; (vi) visibility, transparency, and respect for the privacy of users—make it user-centric.

Another relevant aspect of GDPR refers to the data subject’s rights designed to guarantee their privacy and data protection. These rights are the right to information, the right to access, the right to rectification, the right to suppression, the right to limitation of treatment, the right to data portability, the right to oppose and the right to avoid automated decision-making.

Any breach in personal data must be reported to the data protection authorities and the data subject within 72 h of the company becoming aware of it, according to GDPR. There are different types of fines (less severe or more severe) depending on whether the notification is made on time or whether the data breach is caused by the negligence of the data controller or processor.

Related work

In the literature we can find some tools to assist companies in becoming GDPR compliant. Table 1 shows a comparison of some of these tools. The column indicate the regulations considered in the tools, the general or specific purpose of the tools, whether they support compliance with cloud solutions, analysis of data breaches, Data Protection Impact Assessment (DPIA), whether the tools generate some documents to help in the compliance process, and whether the tools are free. Software compliance has been a relevant research area for decades (Nair et al., 2014). Many software systems have to comply with specific standards and regulations. Standards and regulations can cover different aspects (de la Vara, Ruiz & Blondelle, 2021), such as process or product characteristics or specific quality concerns, such as safety, security, or privacy. Multiple stakeholders, from regulatory authorities to customers, can request and monitor the compliance process. Compliance management can be a complex process in practice because of various challenges (Nair et al., 2015), e.g., having to comply with a large number of criteria, managing and showing compliance cost-effectively, or suitably understanding and following the standards and regulations. Compliance needs depend on the domain and features of the software system under consideration.

According to Ryan, Crane & Brennan (2021), organizations face challenges in meeting GDPR compliance obligations despite having access to a large number of tools intended to assist them. They conclude that the ability of GDPR tools to demonstrate compliance has significant gaps: lack of interoperability, published methodologies or insufficient evidence supporting their validity and utility are the primary problems identified. Buckley, Arner & Barberis (2016) discuss RegTech, a framework for automating, monitoring, and reporting regulatory compliance in financial markets more efficiently and at low costs. The authors also analyze how RegTech systems can be applied to improve GDPR compliance by determining the key success factors.

As examples of general tools, Vanta (Vanta, 2021), PrivIQ (PrivIQ, 2022) and LogicGate (LogicGate, 2022) support general assessments of compliance with GDPR, as well as with other regulations, such as California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), ISO 27001, Health Insurance Portability and Accountability Act (HIPAA), Brazil’s Lei Geral de Proteçäo de Dados (LGPD) and others. However, these tools typically do not address the specific compliance needs of cloud settings in detail. In addition, as they are not free, their use does not contribute to economic saving in SMEs.

There are other tools focused on analyzing GDPR compliance of websites. For instance, Cookiebot (Cookiebot by Usercentrics, 2022) and Ketch (Ketch, 2022). Cookiebot checks whether a website’s use of cookies and online tracking is compliant with GDPR and the ePrivacy Directive (ePR) (European Commission & Directorate-General for the Information Society & Media, 2015). Ketch is focused on cookie analysis, consent, and DSR (Data Subject Request) requests for website and mobile devices. It generates reports containing data collection, exchange, access, and use in all its internal systems.

The Spanish Data Protection Agency (AEPD) provides several tools to help companies in the treatment of personal data, such as FACILITA 2.0 (Spanish Data Protection Agency, 2022a) and Facilita Emprende (Spanish Data Protection Agency, 2022b). Nonetheless, these tools are generic and do not provide specific support for companies offering their services in the cloud. FACILITA 2.0 helps companies to process personal data with little risk of non-compliance. This tool also provides some initial support documents aimed at simplifying the understanding of the obligations of the regulation. However, this tool cannot be used for processing involving high risks to the rights and freedoms of individuals, such as health data or massive data processing, among others. Facilita Emprende is designed for entrepreneurs and new companies (less than 10 years old) that have high growth expectations and conduct treatments that are based on emerging technologies. In this case, data processing is sometimes carried out in the context of the management of a company’s business activities or as a result of its services to third parties, which is not considered low risk.

It is also easy to find publications that propose other general solutions for GDPR compliance in the form of, for example, checklists (Information Commisioner’s Office, 2022), frameworks (Brodin, 2019), processes (Lioudakis et al., 2019), or models (Torre et al., 2021). However, the specific needs of SMEs and cloud services are not adequately addressed, or if they are, these needs are not sufficiently addressed. For example, the suggested checklists can be too short for a thorough GDPR compliance assessment.

Regarding other approaches for compliance management, generic support that applies to multiple standards and systems has been proposed. This support includes metamodels (de la Vara et al., 2022), processes to take advantage of existing languages, such as UML (Panesar-Walawege, Sabetzadeh & Briand, 2013), UML profiles (Giachetti, Marín & De La Vara, 2020) and SPEM (Ardila, Gallina & Muram, 2018), and concrete tool support through the development of novel tools or the integration of various tools, e.g., OpenCert (de la Vara, Ruiz & Blondelle, 2021). Most of this prior work was not developed within the scope of privacy compliance or GDPR compliance, but for different quality properties and specific system types, e.g., safety-critical systems. Regardless of the system type or the standards involved, compliance management in different situations shares characteristics and core principles, such as the need to show that certain requirements are fulfilled. However, for application in GDPR compliance by SMEs that offer cloud services, the way to adapt these generic approaches would need to be established. Furthermore, such adaptations typically result in support that it is not the most suitable because the approaches initially targeted different contexts and purposes. Taking OpenCert as an example, its scope is much wider than what we aim for in this article, and its use for the case that we are dealing with would be more complex and inefficient.

Finally, notice that most companies have migrated their services to the cloud to be more competitive. The cloud allows them to reach a wider market and take advantage of cloud services. When these companies offer services in the EU or outside the EU, they must comply with GDPR when handling the personal data of their clients or employees. Thus, in the scope of the compliance of cloud solutions with GDPR, prior work has analysed its needs (e.g., Russo et al. (2018)) and addressed specific technical aspects. For example, Barati et al. (2022) present a container-based monitoring and auditing architecture for improving data privacy in cloud ecosystems. Blockchain technology is used to implement the architecture, which is compliant with GDPR obligations in tracking cloud provider activities. The system can be used to verify compliance with four GDPR obligations by cloud providers, namely, data protection, minimization, transfer, and storage. Corrales, Jurčys & Kousiouris (2019) propose the use of smart contracts to fine-tune and embed GDPR requirements in the early architectural design. The authors develop a pseudo-code language for these contracts by taking into account legal and technical needs, which could be applied in blockchain contexts. Blockchain has also been considered as a technology to facilitate GDPR compliance by Aujla et al. (2020), who propose an architecture for compliance provisioning, monitoring, verification, and enforcement. For GDPR compliance, as well as security assurance, Rios et al. (2019) present the DevOps framework to support the design, deployment and operation of cloud systems. The framework considers the privacy and security controls necessary to ensure transparency to end-users, third parties involved in service provision, and authorities. The LogicGate (LogicGate, 2022) platform also allows monitoring cloud systems for operational performance, availability, and security. LogicGate complies with applicable data privacy laws, including GDPR. Nonetheless, it does not focus on SMEs’ and DPOs’ needs.

Methodology

In this section, we describe the methodology used in our tool, namely GDPRValidator, to help SMEs in the process of being GDPR compliant. A running example is used to illustrate the whole methodology, which is presented in “Running example”. Afterwards, “Methodology” explains the methodology.

Methodology

Figure 2 illustrates the methodology, which consists of seven phases. Note that the phases framed by dotted lines are optional for SMEs. In the initial methodology phases (left-hand side of figure), the SMEs identify the risk they face when handling personal data. Then, they assess GDPR compliance by answering several questions. SMEs obtain various documents (on the right) that allow them to understand the GDPR requirements and how to become GDPR compliant.

The different phases of this methodology are as follows:

1. Company Details. In this phase, the SMEs fill out their details, such as business name and address, which will be used to provide the generated documentation with this information.

2. Risk Level Evaluation. During this initial phase, the level of data management risk is analyzed. When this risk assessment concludes that there is a high risk for the data handled by the company, the guidelines to carry out a Data Protection Impact Assessment (DPIA) are given. Under GDPR, you must conduct a DPIA whenever you begin a new project that involves a high risk to someone else’s personal information.

3. GDPR General Requirements Analysis. GDPR.EU proposes a checklist (GDPR.EU, 2022d) to help controllers become more secure, protect customer data, and avoid costly fines for noncompliance. During this phase, we use this general GDPR checklist to evaluate SMEs’ compliance with GDPR requirements by using a set of questions based on it.

4. Cloud Privacy Requirements Analysis. This phase focuses on evaluating the privacy requirements needed by SMEs to comply with GDPR. The SME has to answer a cloud-related set of questions. The two previous phases allow the SME to analyse its compliance with the general and cloud-related GDPR requirements. These phases are independent, so the companies can answer the questions of each step independently or answer both parts. This feature makes it easier for the company to use the tool since maybe it had already obtained an initial assessment of its GDPR compliance and has been working, for instance, on the general recommendations. Then, it may only want to assess the cloud-related requirements to obtain the recommendations related to that part. This feature makes GDPRValidator much more efficient to use and makes it easier for SMEs to use.

5. Third Parties Details. In this phase, the SMEs can fill out the details of all those companies (third parties) that wish to access the customers’ data before they give the “consent”. For each of these companies, the SMEs must enter the following information: company category, the purpose for access, action, and duration of storage (in the case of data copy).

6. Additional Recommendations. Before generating the documentation, the company can also indicate whether or not it wants to obtain the additional recommendations offered by the tool to improve its GDPR compliance.

7. Generation of Documentation. In this phase, the GDPRValidator tool generates the corresponding SME documentation according to the result of the risk evaluation and the answers given by the company to the questions defined in the previous phases. The company receives several documents from this phase. These documents allow the company to adjust its security policies to comply with GDPR. These include those documents that a company should provide to its customers and those that it should use for internal control in GDPR compliance. The documents are available in .doc format. For its customers, the company obtains three documents:

• A document containing the information specified in article 13. It includes information that the controller must provide to the customer. For instance, some of this information is the controller identity and contact details or the data protection officer, if any.

• A report explaining the rights of the customers (Altorbaq, Blix & Sörman, 2017) and how they may exercise those rights, chapter 3, articles 12–23.

• A document that enables obtaining of the consent of the customer allowing access to its data.

For the internal control of the company, the tool generates the following documents:

• A report of processing activities (RPA) according to article 30. In GDPR, this document is mandatory for large companies, but it is also recommended for SMEs.

• A document to inform the supervisory authorities of security breaches, as outlined in article 33.5. In the case of a personal data breach, the controller must inform the supervisory authority competent without undue delay and, where feasible, not later than 72 h after becoming aware of it, as article 55 stipulates. If there is a personal data breach, the controller must document the facts relating to the breach, its effects, and the remedial actions taken. This report must include an explanation if it is not sent within 72 h.

• A document containing the data protection impact assessment (DPIA), in accordance with article 35. In cases of automated data evaluation of personal aspects, such as profiling, processing special categories of data on a large scale (article 9), criminal convictions and offenses (article 10), or systematic monitoring in a publicly accessible area on a large scale, the document is required.

• A report with data security recommendations. In this document, the company will find some helpful recommendations for GDPR compliance.

After completing all these phases, and taking into account the actions performed to solve the problems encountered, the SME can repeat the whole process to determine the GDPR compliance. Finally, it is important to remark that once the tool execution finishes, the data provided by the company during the process is destroyed to guarantee the company’s privacy.

Gdpr compliance validation

This section presents the guidelines used in our tool. An SME can use GDPRValidator to assess its GDPR compliance by checking whether these guidelines are followed. As a result, it provides suggestions to help the company comply with them.

We divide the following description into five sections. The first section describes the risk level evaluation, corresponding to methodology phase 2 (Fig. 2), in which a categorization of the risks and the importance of performing the DPIA are explained. The second section lists the general guidelines for the data controller, based on the GDPR checklist (GDPR.EU, 2022d), methodology phase 3. The third section focuses on cloud security requirements, methodology phase 4. In the fourth section, we present several additional suggestions to help companies comply with GDPR, methodology phase 6. Finally, the last section summarizes the results.

Validation of cloud-related GDPR compliance guidelines

There are many benefits of storing data in the cloud, such as lower data storage and management costs. There is also often less chance of data loss. However, most companies that contract cloud storage services have raised concerns about potentially violating GDPR compliance requirements by storing data in these systems. This concern could stem from a perceived loss of control once the data is in the cloud. A set of questions is provided in this section to help SMEs determine whether their cloud provider complies with GDPR.

Figure 3 shows how the GDPR roles interact in a cloud system. We can see that the SME is the controller of the customers’ data, being responsible for the treatment of this data. Note that the company’s customers must sign an SLA with the company regarding their data treatment. Then, the SME can hire cloud services to store its customers’ data on some storage machine in the cloud system. The SME also signs an SLA with the CSP, which allows it to be joint controller (article 26). Thus, each cloud storage machine, on which the data is stored becomes a data processor and is responsible for processing the data (article 28). Then, any third party that obtains the corresponding “consent” should be able to access the stored data. The controller and joint controller shall implement the appropriate technical and organizational measures to ensure, and be able to demonstrate, that processing is performed in accordance with this regulation (articles 24 and 26).

The main questions that allow GDPRValidator to validate GDPR compliance are inspired by Deloitte (2022), Combell (2020). Below we list only a few of these questions and the suggestions that will be added to the report generated for GestF, including data privacy recommendations, using the running example as an illustration. The complete list is available in Appendix A.

• 1. Contracts.

• (a) Has the CSP signed an SLA for data processing with any third parties who access/process personal data?

• If GestF answers no to this question, then the following suggestion is added: For GDPR compliance, almost all services require a standard data processing agreement, which includes any third party services that handle your data subjects’ personal information. It is imperative to only work with third parties who can provide adequate data protection guarantees. This suggestion complements the related one in point 3 under Accountability and governance in the general GDPR compliance guidelines.

• 2. Duration.

• (a) Does your company establish a date for data retention?

• If GestF answers no to this question, then the following suggestion is added: The storage of data should not exceed the necessary storage time. The SLA signed with the CSP must specify the processing duration. After the retention period has expired, all data, including copies, must be deleted.

• 3. Information.

• (a) Does your company specify a procedure to notify when a breach is detected?

• If GestF answers no to this question, then the following suggestion is added: GDPR in the article 4 determines what is considered a breach in the collection, retention, and processing of data: “the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed”. Then, the company must specify the procedure that it follows to notify when a breach is detected, for instance, in the event of theft or a leak. Before a breach is reported in the media, the CSP should inform your company, and your company should notify its customers and supervisory authorities. According to article 36, the controller must report any breach of personal data to the supervisory authority competent under article 55 within 72 h of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. This suggestion complements the related one in point 2a under Data security in the general GDPR compliance guidelines.

• 4. Privacy rights.

• (a) Can your company access and delete the customers’ data from the cloud?

• If GestF answers no to this question, then the following suggestion is added: Your company has the right to access its customers’ data and have them deleted, the right to access (article 15), and the right to erasure (“to be forgotten”, article 17). The CSP must facilitate this process by making the data available to your company and your customers in a structured format. It is also important to consider data backups when deleting customer data.

• 5. Data Protection Impact Assessment (DPIA).

• (a) Does the CSP have a Protection Impact Assessment (DPIA) that determines the risks associated with cloud hosting or services?

• If GestF answers no to this question, then the following suggestion is added: The CSP, as a joint data controller, should also have a DPIA (see “Data protection impact assessment”) that determines the risks associated with cloud hosting or services. It is recommendable, but not mandatory. The CSP must send this DPIA to your company every time that it is updated. This suggestion complements the related one in point 1a under Lawful basis and transparency in the general GDPR compliance guidelines.

• 6. Third Parties.

• (a) Do you have third parties in the cloud requesting “consent” to access your customers’ data that are not included as recipients in your contracts?

• In this case, only when GestF answers yes to this question is the following suggestion added: Your company must have the identification of those companies that wish to access your customer’s data before the “consent” is given, as well as the purpose of the access, the action to be carried out on the data and, in the case of copying this data, the duration of storage of that copy.

GDPRVALIDATOR

In this section we present a description of the GDPRValidator tool. Web-based access is available at http://pluton.i3a.uclm.es:8080/, and it follows the methodology outlined in “Methodology”. Professionals and businesses who handle personal data can benefit from this tool, as it allows them to evaluate the security of their processing of personal data. It also allows them to obtain a report with recommendations that help ensure data privacy in the context of GDPR. The company’s data is destroyed after the tool’s execution is complete and the set of documents is obtained. The resulting documents will only be valid if the answers to the questions are authentic and current.

Design and interface

This web-app starts with a simple front page that has a brief description of the tool and a fragment of Fig. 2 including the sequence of steps in the main process. After these, a button takes the user to the beginning of the process, the SME’s data form. GDPRValidator also includes an about page, reachable from any of the other ones, which expands on the information provided about the tool on the front page. Note that on each GDPRValidator page we have included a 6-step roadmap showing which stage the user (the SME or DPO) is at. Figure 4 shows the tool’s page for registering the SME’s details, via which the company can fill in its information using the form fields needed for its identification. Note that this information is not stored, it is used only to adapt the resulting documents to the company in question. Nonetheless, they must review and complete them with more specific information.

Figure 5 shows both the interface screens of the GDPRValidatorś checklists pages, this is, the general GDPR guidelines, established by the official EU checklist (GDPR.EU, 2022d), and the cloud-related guidelines, introduced in “Validation of Cloud-related GDPR Compliance Guidelines”. As can be seen, both consist of a series of yes/no questions, defined in “GDPR compliance validation”. Each question also has a dropdown box that shows the resulting recommendation when selected. Before answering any questions, an option is provided to skip these pages, which are independent and optional steps in the tool’s process.

Lastly, Fig. 6 shows the final page of the process. First, it states that the company using the tool must complete all the documents obtained to include any additional information regarding the data processing. The page provides a series of basic general guidelines for GDPR conformance. Then, it also contains a check box that SMEs can optionally mark if they want to receive the additional recommendations included in “Additional Sugestions to GDPR Compliance”, in addition to those resulting from the previously explained checklists. As a final step, users will receive all the documentation generated by clicking the “FINISH” button.

Validation

The main goal of the validation is to study whether GDPRValidator is a feasible means of enabling SMEs that use cloud services to assess GDPR compliance. “Design” presents the design of the validation, and “Results” shows the results obtained. Finally, we discuss the validation and its results in “Discussion”.

Conclusions

In this article, we have presented the GDPRValidator tool, which is designed to help SMEs be GDPR compliant. Many SMEs take advantage of the cloud to offer their services and want to expand to international markets. As a result, they must protect their customers’ data to prevent it from being compromised, which would lead to their customers losing trust in the company and the possibility of substantial fines.

Most SMEs are unaware of what constitutes personal information and whether it is stored on the local machine or in the cloud. In addition, they lack the resources and technical expertise to locate and identify such data. GDPR, the EU regulation for data protection, establishes the legal framework for protecting the personal data of European citizens. It defines guidelines to help companies to protect the data they manage. In this work, we have proposed a tool to help non-legally trained SMEs in the process of guaranteeing the privacy of their customers’ data. For this purpose, GDPRValidator provides them with several documents. Furthermore, this tool is aimed at SMEs since their budget is usually insufficient to allow the hiring of legal experts. However, it could also be beneficial for DPOs working for bigger companies as it could facilitate their work.

In the implementation of GDPRValidator, we have considered the main concepts of GDPR, such as the purpose of data access, consent to access, DPIA, or data management audits, taking into account general and cloud-related GDPR requirements. In addition, some additional recommendations are given to facilitate SMEs’ GDPR compliance process.

The GDPRValidator tool generates a set of documents and several templates necessary to manage the GDPR compliance process. Some of these documents are templates for DPIA or requests for consent for third parties to access data containing the SME’s details.

Thus, an SME can more easily understand the documentation that it must handle in complying with GDPR, which facilitates the steps to follow without knowing the regulation or consulting an expert. However, although our tool provides general information, in the case of having specific doubts about certain special situations, the help of a professional may be necessary to resolve them, even though consultations with experts usually come at a high price. In any case, by using GDPRValidator, companies would have the documentation needed to be GDPR compliant and reduce the cost of these legal consultations.

In the future, we plan to extend our tool to perform a complete data risk analysis. We also intend to add the functionality of estimating a GDPR compliance level, so that SMEs that implement the GDPRValidator recommendations will be able to see how they have improved their compliance. A method to perform this calculation objectively will need to be explored, and this will involve consulting various regulatory experts on how best to do so.

Appendix a

All questions of the checklist for GDPR compliance of the general GDPR compliance guidelines:

• 1. Lawful basis and transparency. According to article 6 and recital 40, personal data should only be processed with the consent of the data subject, in this case the customers, or on another legitimate basis. Recital 58 and article 12 regulate the transparency of information. Some related questions on the checklist are the following:

• (a) Does the company conduct an information audit to determine what information is processed and who has access to it?

• Report suggestion: The most effective way to demonstrate GDPR compliance is to conduct a data protection impact assessment (DPIA), article 35. Among other things, the DPIA must include the purpose of the processing, the types of data you process, who has access to it in the organization, any third parties (and their location) who have access, and how you plan to protect the data (such as encryption), and when you plan to erase it (if possible). The CSP must provide your company with all this data access information. Therefore, the CSP should prepare its DPIA to keep track of all cloud accesses. This issue can be agreed upon when signing the SLA with the CSP. Your company will need to ask the CSP for their DPIA to complete their DPIA.

• The GDPRValidator framework allows companies to assess whether they need a Data Protection Impact Assessment GDPR.EU (2022b) (DPIA), see “Data Protection Impact Assessment”, and generates a draft of it.

• (b) Is there a legal justification for your data processing activities?

• Report suggestion: The possible answers to this question relate to the legal basis for the processing defined by article 6. When the legal basis is “consent”, that is, the data subject (in your case, your customer) has given consent to data access, your company has additional obligations that include offering data subjects the opportunity to revoke this consent. In the case of processing for “legitimate interests” pursued by the others (your company, the CSP, or by a third party), article 6. f, an assessment of privacy impacts must be conducted by your company. There are other provisions in articles 7 to 11 related to children and special categories of personal data.

• (c) Does the company provide clear information about your data processing and legal justification in your privacy policy?

• Report suggestion:

• This information should be included in your privacy policy and provided to data subjects when their data are collected. Data subjects must be informed about the data collected about them and why, according to article 12. You must report how the data is processed, who has access to it, and how it is kept safe.

• 2. Data security. Whenever personal data is processed, the company needs to follow the data protection principles outlined in article 5. Some of the questions that allow us to evaluate the security of data processing are the following:

• (a) From the moment projects begin to develop products to each time data are processed, does the company consider data protection at all times?

• Report suggestion: The company should evaluate whether the company applies the principles of “data protection by design and default” defined in article 25, such as implementing “appropriate technical and organizational measures”.

• (b) When a data breach occurs, does your company have a procedure for contacting the authorities and your data subjects? It is important to consider that, according to GDPR, a data breach that exposes personal data must be reported to the supervisory authority within 72 h.

• Report suggestion: Here, we provide a list of the EU member states’ supervisory authorities. And we include in the recommendation report the following: According to article 34, you must also notify the supervisory authority and your customers immediately, within 72 h, if there is a data breach. Unless the breach is unlikely to put them at risk, for instance, if the data stolen is encrypted.

• (c) Whenever possible, does the company protect personal information by encryption, pseudonymization, or anonymization?.

• Report suggestion: Your company must implement cryptography or pseudonymization as often as possible under the GDPR.

• (d) Does your company create an internal security policy for your team members and build awareness about data protection?

• Report suggestion: The GDPR requires additional training for employees with access to personal data and non-technical employees. The provision of training courses for your company’s staff is recommended.

• (e) Has your company established a process for conducting a data protection impact assessment? We do not need to consider this question, because it is related to question 1.a.

• 3. Accountability and governance. Accountability for data protection refers to taking responsibility for actions and decisions regarding data protection, while governance refers to controlling and directing data protection. The two concepts are interdependent, article 5.

• (a) Has your company signed a data processing agreement with any third parties who process personal data on your behalf?

• Report suggestion: For GDPR compliance, almost all services require a standard data processing agreement, which includes any third-party services that handle your data subjects’ personal information. A template for this agreement is available at https://gdpr.eu/data-processing-agreement/, and it must be visible on your website and specify the rights and obligations of each party. It is imperative to only work with third parties who can provide adequate data protection guarantees. Thus, the SLA with the CSP must specify the list of permitted third parties.

• (b) Has your company appointed a Data Protection Officer (if necessary)?

• Report suggestion: There are some circumstances in which organizations are required to have a Data Protection Officer (DPO). These conditions usually arise when a company’s activity involves large-scale data processing or sensitive or special categories of data are processed, according to articles 9 and 10. A DPO should be an expert in data protection. This officer should have duties that include monitoring GDPR compliance, assessing data protection risks, advising on data protection impact assessments, and cooperating with regulators. In any case, although having a DPO is not mandatory, it is recommended.

• (c) Has your company appointed someone to ensure GDPR compliance?

• Report suggestion: According to the guidelines of “data protection by design and by default”, article 25, GDPR compliance must be assigned to someone within the organization. Data protection policies must be evaluated and implemented by this individual.

• (d) Does your company appoint a representative within an EU member state if it is not an EU member?

• Report suggestion: If you process data relating to individuals in a particular country, you must designate a representative there who can communicate with the data protection authority on your behalf, article 27. In cases where EU citizens are affected by processing in the multiple Member States, the GDPR does not provide guidance. In this case, it may be prudent to designate a representative in a member state that speaks your language.

• 4. Privacy rights. Following article 12, the controller shall facilitate the exercise of data subjects’ rights under articles 15 to 22. A controller may not deny the customers’ rights unless the controller can demonstrate that it is not in a position to identify them, article 11.

• (a) Can your customers easily access all the information you have about them?

• Report suggestion: First, your organization should ensure that the client requesting the data is verified. Your customers have the right to know what personal information your company has about them, how it is used, how long it is stored, and why it is stored, article 15. You must respond to these requests within one month, article 16. This information is sent for free the first time it is requested, but subsequent copies may have a cost.

• (b) Do your customers have the ability to update inaccurate or incomplete information easily?

• Report suggestion: First, your company needs to check the identity of the customer asking for the information. Make sure your company has a process that allows customers to audit their data and update their personal information if necessary, article 15. Your company must respond to these requests within one month, article 16.

• (c) Do your customers have the option of deleting their personal information?

• Report suggestion: It is also necessary to verify the identity of the person making the request. Customers have the right to request the deletion of all their data held by your company, article 17, also called the right to be forgotten. You can refuse the request in certain circumstances, such as exercising freedom of speech or fulfilling a legal obligation. These requests must be answered within one month, article 16.

• (d) Can your customers ask you to stop processing their data easily?

• Report suggestion: Several grounds allow your customers to restrict or stop the processing of their data, see article 18. Usually, this happens when there is a dispute over whether the processing is lawful or accurate. However, you can still store their data while processing is restricted. The customers must be notified before you resume processing their data. Your company has to send this notification within a month.

• (e) Do your customers have the option of receiving a copy of their data in a form that can be easily transferred to a different company?

• Report suggestion: Therefore, your organization should be able to send the customer data in a commonly readable format, either directly to them or to a third party they choose, article 20. Your customer data may be given to your competitor, which may seem unfair from a business perspective. However, from a privacy perspective, the idea is that people own their data, not you.

• (f) Do your customers have the option to object to the processing of their data?

• Report suggestion: If your organization processes customers’ data for direct marketing, it must cease doing so immediately for that purpose, article 21. On the other hand, you may be able to challenge their objection if you demonstrate “compelling legitimate grounds”.

• (g) Does your organization have procedures to protect individuals whose rights are affected by automated processes?

• Reporting suggestion: Some organizations use automated processes for decisions that affect people with legal effects or “of similar importance”, article 22. If you think that applies to your organization, you need to create procedures to guarantee their rights and protect their freedoms and legitimate interests. Your company must make it easy for customers to request human intervention, evaluate decisions, and question them.

• 5. Third Parties.

• (a) Do you have third parties requesting “consent” to access your customers’ data that are not included as recipients in your contracts? For each of these companies, please enter the following information: company category, the purpose for access, action, duration of storage, in the case the data is copied.

• Report suggestion: Your company must have the identification of those companies that wish to access your customer’s data before the “consent” is given, as well as the purpose of the access, the action to be carried out on the data and, in the case of copying this data, the duration of storage of that copy.

All questions in the checklist for GDPR compliance of the cloud-related GDPR compliance guidelines:

• 1. Contracts.

• (a) Has your company signed an SLA with the CSP to be responsible for the treatment of personal data on your behalf?

• Report suggestion: Your company must sign an SLA with the CSP responsible for processing your customers’ data, acting as the joint controller, article 26. The SLA should identify the responsibilities of the SME and the CSP, as controller and joint controller, in a transparent manner. Specifically, concerning the exercise of rights of the interested party (customers) and their respective responsibilities to provide the information referred to in articles 13 and 14, the agreement may designate a point of contact for these interested parties. It is important to keep contracts updated.

• Furthermore, your company needs to ensure that the hired CSP must declare adherence to the EU Cloud Code of Conduct (EU Cloud COC) Calder (2021) about its cloud service, article 40. It provides cloud-specific approaches and recommendations, including a road map that tracks code requirements to GDPR and international standards such as ISO 27001 Beckers (2015) and 27018 de Hert, Papakonstantinou & Kamara (2016)⁵ . In addition, the CSP and the competent supervisory authority must certify that the cloud service fully complies with the provisions in the code.

• (b) Has the CSP signed an SLA for data processing with any third parties who access/process personal data?

• Report suggestion: For GDPR compliance, almost all services require a standard data processing agreement, which includes any third party services that handle your data subjects’ personal information. It is imperative to only work with third parties who can provide adequate data protection guarantees. This suggestion complements the one in the point 3 of the checklist related to Accountability and governance in the general GDPR compliance guidelines.

• 2. Duration.

• (a) Does your company establish a date for data retention?

• Report suggestion: The storage of data should not exceed the necessary storage time. The SLA signed with the CSP must specify the processing duration. After the retention period has expired, all data, including copies, must be deleted.

• 3. Information.

• (a) Does your company specify a procedure to notify when a breach is detected?

• Report suggestion: GDPR in the article 4 determines what is considered a breach in the collection, retention, and processing of data: “the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed”. Then, the company must specify the procedure that it follows to notify when a breach is detected, for instance, in the event of theft or a leak. Before a breach is reported in the media, the CSP should inform your company, and your company should notify its customers and supervisory authorities. According to article 36, the controller must report any breach of personal data to the supervisory authority competent under article 55 within 72 h of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. This suggestion complements the related one in point 2a in Data security in the general GDPR compliance guidelines.

• (b) Does the CSP explicitly inform your company where each customer’s data is stored?

• Report suggestion: All data of European citizens should either be stored in the EU, so that they are subject to European privacy law, or in a place where the same level of protection is guaranteed. Your company is responsible for arranging with the CSP the location for storing the customers’ data. The SLA, signed between the CSP and the company, should include this information.

• 4. Privacy rights. Some of these questions are related to the ones shown in the general GDPR compliance guidelines (Privacy rights 6) but applied in the cloud context.

• (a) Can your company access and delete the customers’ data from the cloud?

• Report suggestion: Your company has the right to access its customers’ data and have them deleted, the right to access (article 15), and the right to erasure (“to be forgotten”, article 17). The CSP must facilitate this process by making the data available to your company and your customers in a structured format. It is also important to consider data backups when deleting customer data.

• (b) Does your company retain ownership and control of your customers’ data at all times?

• Report suggestion: As controller, your company must retain ownership and control of your customers’ data at all times. To ensure that your company retains ownership and control of your customers’ data at all times, the corresponding SLA should include this condition.

• (c) Does your company have information about the metadata that the CSP collects?

• Reporting suggestion: Your company should ask the CSP what metadata it collects and whether your company has a right to opt out. The CSP must guarantee that it will inform your company about this metadata, so this condition should also be included in the contract.

• 5. Data Protection Impact Assessment (DPIA).

• (a) Does the CSP have a Protection Impact Assessment (DPIA) that determines the risks associated with cloud hosting or services?

• Report suggestion: The CSP, as a joint data controller, should also have a DPIA (see “Data Protection Impact Assessment”) that determines the risks associated with cloud hosting or services. It is recommendable, but not mandatory. The CSP must send this DPIA to your company every time that it is updated. This suggestion complements the related one in point 1a, under Lawful basis and transparency in the general GDPR compliance guidelines.

• 6. Third Parties.

• (a) Do you have third parties in the cloud requesting “consent” to access your customers’ data that are not included as recipients in your contracts? For each of these companies, please enter the following information: company category, the purpose for access, action, and duration of storage, in the case of the data being copied.

• Report suggestion: Your company must have the identification of those companies that wish to access your customer’s data before the “consent” is given, as well as the purpose of the access, the action to be carried out on the data and in case of copying this data, the duration of storage of that copy.