Data Privacy and Governance

What it is

Data governance is the set of rules, roles and controls that decide how data is collected, stored, shared and removed. Privacy is the part that protects personal data and the rights of the people it describes.

On AWS these rules turn into technical controls: finding sensitive data, limiting where it can live, checking that configuration stays compliant, and being able to prove it.

How it works

Classify and discover

You first need to know what sensitive data you hold. Amazon Macie uses machine learning and pattern matching to find sensitive data in S3, such as names, addresses, financial details and credentials. It also reports on bucket security, such as public access or missing encryption.

Run Macie discovery jobs on schedules, and send findings to Amazon EventBridge and AWS Security Hub for follow up. Tag data with its classification, for example public, internal, confidential, or restricted, and use those tags to drive permissions, for example with LF tags or ABAC.

Shared responsibility

AWS is responsible for the security of the cloud, which means the facilities and the managed service infrastructure. You are responsible for security in the cloud: your data, its classification, encryption choices, access policies and configuration. AWS Artifact gives you AWS compliance reports and agreements to support your own audits.

Data residency and sovereignty

Some laws require data to stay in a country or region. In AWS, data stays in the Region where you store it, unless you copy or replicate it somewhere else.

Be careful with features that move data across Regions, such as S3 replication, Redshift snapshot copy, DynamoDB global tables, AWS Backup copies and cross Region disaster recovery plans. Use a service control policy with the aws:RequestedRegion condition key to deny actions outside approved Regions.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyOutsideApprovedRegions",
    "Effect": "Deny",
    "NotAction": ["iam:*", "organizations:*", "support:*"],
    "Resource": "*",
    "Condition": {
      "StringNotEquals": { "aws:RequestedRegion": ["eu-west-1", "eu-central-1"] }
    }
  }]
}

Organizations and guardrails

AWS Organizations groups accounts into organizational units (OUs) and applies SCPs to set the outer limits of what accounts can do. AWS Control Tower sets up a multi account environment with guardrails, which are preventive or detective rules. Separate accounts for production data, development and logging limit the reach of mistakes.

Continuous compliance

AWS Config records resource configuration and checks it against rules, for example "S3 buckets must be encrypted" or "no public buckets". Non compliant resources can trigger remediation through Systems Manager Automation or Lambda. Conformance packs bundle rules for a standard.

Privacy rights and deletion

Privacy laws such as the GDPR (General Data Protection Regulation) give people rights, including access and erasure of their personal data. To honor an erasure request you need to know every place the data lives: raw files, curated tables, backups, caches and replicas.

Design for this early. Use a stable person key, keep personal data in few well known locations, and prefer table formats such as Apache Iceberg that support row level deletes.

Set backup retention so that deleted data ages out of backups in a defined time. Keep a record of the request and the action taken.

Sharing data safely

Share data with controls instead of copies. Options include Lake Formation grants and cross account sharing, Redshift data sharing, S3 Access Points and AWS Data Exchange for third party datasets. AWS Clean Rooms lets several parties analyze combined data without exposing the raw data to each other.

Before sharing, mask or anonymize sensitive fields, and use encryption keys that you control so you can revoke access.

Governance roles and processes

Name a data owner for each dataset and a steward who looks after quality and metadata. Keep a catalog with descriptions, classification and lineage.

Review access regularly and remove permissions that are no longer needed. Document retention periods and who approves exceptions.