How AWS Can Help
Table 1 – How AWS can help you navigate GDPR compliance
| Area | Description | AWS Services and Tools | |
|---|---|---|---|
| Strong Compliance Framework | Appropriate technical and organizational measures may need to include “the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of the processing systems and services.” |
SOC 1 / SSAE 16 / ISAE 3402 (formerly SAS 70) / SOC 2 / SOC 3 PCI DSS Level 1 ISO 9001 / ISO 27001 / ISO 27017 / ISO 27018 / ISO 27701 NIST FIPS 140-2 Common Cloud Computing Controls Catalog (C5) |
|
| Data Access Control | The controller “…shall implement appropriate technical and organizational measures for ensuring that, by default, only personal data that are necessary for each specific purpose of the processing are processed.” | AWS Identity and Access Management (IAM) |
|
| Amazon Cognito |
|||
| AWS Shield |
|||
| AWS Resource Access Manager |
|||
| Amazon CloudFront |
|||
| AWS Organizations |
|||
| AWS CloudTrail |
|||
| Monitoring and Logging |
“Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility.” “…the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk […]” |
AWS Config |
|
| Amazon CloudWatch |
|||
| AWS Control Tower |
|||
| Amazon GuardDuty |
|||
| Amazon Detective |
|||
| Amazon Inspector |
|||
| Amazon Macie |
|||
| AWS Systems Manager |
|||
| AWS Security Hub |
|||
| Amazon Security Lake |
|||
| AWS Tools and SDKs |
|||
| Protecting your Data on AWS | Organizations must “implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the pseudonymisation and encryption of personal data.” | AWS Certificate Manager |
|
| AWS CloudHSM |
|||
| AWS Key Management Service |
|||
| AWS Nitro Systems |
|||
