“The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.”
GENERAL DATA PROTECTION REGULATION (GDPR), RECITAL 26
Your organisation has to prove that a production environment is clearly separated from non-production environments. BizDataX creates non-production environment by implementing key data protection concepts defined in GDPR – data anonymization and data pseudonymization techniques.
Data anonymization is, along with the generation of the synthetic data, the best method for data protection. By anonymizing data for certain environments and processes, organizations narrow the reach of the GDPR, lowering related data protection costs and risks. In case of data anonymization, BizDataX applies a number of data anonymization activities on sensitive data assuring that re-identification of a natural person is impossible. For more information and technical details, please see data masking section on the website.
Data pseudonymization technique replaces data that could lead to a direct identification of a natural person with pseudonyms (aliases) but preserves the link between the pseudonyms and identifiers (original values belonging to the natural person including name, family name, email, credit card info etc.) in a separate data store. What you get when you pseudonymize data are basically two data stores, one data store with pseudonyms and other non-sensitive data and the other data store with the link between pseudonyms and the identifiers. In contrast to the data stores that are anonymized, pseudonymized data stores do contain real data, so there are no losses in terms of data quality.
Organizations that use data pseudonymization to process production data for non-production purposes are NOT exempt from the GDPR. However, special and less strict rules apply, i.e. you have to protect the store that contains the links and then you are good to go.
When data pseudonymization is the preferred option, BizDataX will create an additional data store holding links between pseudonyms and the identifiers. Within the workflow, the content of each sensitive field (identifier) will be replaced by a pseudonym. The pair pseudonym-identifier will be stored in this separate data store that has to be safeguarded.
With BizDataX personal data is anonymized and there is no way for an unauthorized person, who is able to access a non-production data store, to find out what data belongs to an actual natural person. In a real-world scenario, it takes a lot of time and resources to analyze data, implement rules and provide anonymized or pseudonymized data for secondary usage. With BizDataX and the expertise of our team, the time and resources will be reduced to minimum allowing organizations to comply with GDPR in much less effort than expected.
