Overview

If you handle personal data belonging to people in the EU/EEA (or the UK under UK GDPR), the law places duties on you. This article explains the roles involved and the practical steps to stay compliant when running workloads on ALYPOD Cloud.

Before you begin

• Understand what personal data you store — any information that identifies a living person.

Key concepts

• Data controller: the organisation that decides why and how personal data is processed. If you run the website or app, that is usually you.
• Data processor: a third party that processes data on the controller's instructions. A hosting provider used to store or transmit your data can act as a processor.
• Data Processing Agreement (DPA): the contract between controller and processor setting out obligations. ALYPOD can provide a DPA — contact support to request one.
• Data residency: where data physically lives. You control the region of your Pod when you deploy it, so choose a region that satisfies your legal requirements.

Steps

1. Map your data. Record what personal data you hold, where it lives (which Pods, Storage Boxes, S3 buckets, databases), and who can access it.
2. Minimise and set retention. Collect only what you need and delete it when it is no longer required.
3. Encrypt in transit and at rest. Use TLS/SSL for all web traffic and keep backups encrypted.
4. Control access. Use individual accounts, least privilege and audit logins.
5. Document your lawful basis for processing (for example, consent or contract).
6. Be able to honour data subject rights — access, correction, deletion and portability. Know how you would export or erase a user's data.
7. Report breaches. Notify your supervisory authority within 72 hours of becoming aware of a personal data breach, where it is likely to pose a risk to individuals.

Troubleshooting

• Problem: You are unsure whether ALYPOD is a controller or processor for your setup. Solution: In nearly all cases you are the controller for data on your Pod; contact support to discuss a DPA.
• Problem: You need to delete a user's data. Solution: Identify every location (databases, backups, object storage) before confirming the deletion as complete.

Related articles

• [Configuring a TLS / SSL certificate]
• [Auditing logins and access]
• [Security best practices for your Pod]