Data subject rights in the cloud: A grounded study on data protection assurance in the light of GDPR

The new European General Data Protection Regulation GDPR requires that organisations placing personal data on cloud services can protect certain rights of data subjects, such as their right to access, demand erasure and rectification of their data. Due to the technical complexity and shared environment of cloud services, the flow of personal data in the cloud must be secured and controlled from its initial collection, via processing, to final erasure. This has proved to be both organisationally and technically challenging. This study identifies the related challenges and outlines potential solutions for organisations who need to be able to adequately demonstrate compliance with the regulation as well as to respond to rights requests from data subjects. The study is based on interviews with ten data protection experts. The semi-structured interviews were qualitatively analysed, using an approach informed by Grounded Theory. The contribution of this study is a refined model depicting stages of a personal information life-cycle. Additionally, twelve challenges and fourteen recommendations were identified and presented to the various stages of the model. Both clients and providers of cloud services are expected to benefit from these results, as well as the data subjects, whose rights are protected.