CGPulse

Sign In

GDPR: Data Protection Controls

AWS 40 automated checks

Technical controls supporting GDPR compliance for AWS resources, focusing on data protection, encryption, and access control

Access Control (Art. 25)

IAM root user must not have access keys Critical
IAM user must have MFA enabled Critical
IAM group should be used for permission management Low
Cognito user pool must enforce MFA Critical

Accountability (Art. 30)

IAM password policy must require minimum length of 14 Art.30 · Medium

Awareness

Organization should provide GDPR awareness training to all staff Art.39 · Medium

Breach Notification

Organization should have breach notification procedures Art.33-34 · Critical

Breach Notification (Art. 33)

IAM password policy must require minimum length of 14 Art.33 · Medium

Consent

Organization should implement valid consent mechanisms Art.7 · High

Data Integrity (Art. 5)

S3 bucket must have versioning enabled High

Data Protection (Art. 32)

S3 bucket must block all public access Critical
RDS instance must not be publicly accessible Critical
Redshift cluster must not be publicly accessible Critical
Security group must not allow unrestricted ingress (0.0.0.0/0) Critical
EKS cluster must disable public API endpoint access High

Data Protection Officer

Organization should appoint a Data Protection Officer where required Art.37 · High

Data Subject Rights

Organization should have procedures to handle data subject access requests Art.15 · High
Organization should implement right to erasure procedures Art.17 · High
Organization should support data portability requests Art.20 · Medium

Encryption (Art. 32)

Governance (Art. 37)

IAM password policy must require minimum length of 14 Art.37 · Medium

Impact Assessment

Organization should conduct Data Protection Impact Assessments for high-risk processing Art.35 · High

International Transfers

Organization should have safeguards for international data transfers Art.44-49 · High

Key Management (Art. 32)

KMS key must have automatic key rotation enabled High

Lawful Processing

Organization should document lawful basis for all personal data processing Art.6 · Critical

Network Security (Art. 32)

VPC must have flow logs enabled High

Privacy by Design

Organization should implement data protection by design and by default Art.25 · Medium

Processor Management

Organization should have data processing agreements with all processors Art.28 · Critical

Processor Management (Art. 28)

IAM password policy must require minimum length of 14 Art.28 · Medium

Risk Assessment (Art. 35)

IAM password policy must require minimum length of 14 Art.35 · Medium

Storage Limitation

Organization should define and enforce data retention schedules Art.5(1)(e) · High

Transparency

Organization should provide transparent privacy notices Art.13-14 · High

Transparency (Art. 13/14)

IAM password policy must require minimum length of 14 Art.13 · Medium

Measure your GDPR: Data Protection Controls posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation