Lucy McGrath

Lucy is VP, Privacy at Auth0. She's a lawyer and global data privacy expert with diverse experience working with some of the world's leading media and technology companies. As Auth0’s VP, Privacy, she leads global data privacy strategy and is driven by a passion for further embedding privacy-by-design and continuing to shape our culture of privacy that starts with finding the humans that we impact every day.

VP, Privacy

LGPD carries implications for businesses beyond Brazil’s borders. Here’s what execs need to know.

Lei Geral de Proteção de Dados Pessoais (LGPD or General Personal Data Protection Law) is Brazil’s data protection and privacy law that is closely modeled on the General Data Protection Regulation (GDPR) in the European Union. LGPD was passed by the National Congress of Brazil on July 10, 2018, in an effort to unify and enhance 40+ data privacy instruments within the country into a single piece of legislation. LGPD went into effect on September 18, 2020. Like the GDPR, the law impacts global organizations beyond Brazil’s borders.

The extent to which LGPD applies to your organization will depend on the specific nature of your business, so you should always seek skilled legal counsel to help you navigate compliance requirements. However, if your organization does business in Brazil or collects/processes the data of any individual within Brazil, you should familiarize yourself with LGPD’s requirements (summarized below) to understand what impact these regulations may have on you.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Important Information</strong><br> 
  <b>The following information is not intended as legal advice, and readers should consult with their attorneys about matters of compliance.<br> 
</div>

## Why LGPD Was Passed

LGPD was passed to demonstrate and protect individuals’ right to privacy. Despite Brazil being [Latin America’s technology leader](https://www.launchwaymedia.com/blog/brazil-latin-americas-technology-leader) and [one of the top 10 tech markets](https://www.zdnet.com/article/it-investments-in-brazil-surpass-world-average/) in the world, its data protection laws have failed to keep pace with this technological growth. As a side-effect of that rapid growth, Brazil has experienced a number of recent [high-profile data breaches](https://portswigger.net/daily-swig/brazil-reaches-towards-cybersecurity-maturity). LGPD establishes a clear requirement for organizations to implement controls that protect individuals’ personal data, with the end goal of reducing the impact of breaches on individuals.

### LGPD Establishes the National Data Protection Authority

In addition to introducing privacy regulations, the LGPD also established a separate national authority, the Autoridade Nacional de Proteção de Dados (ANPD or National Data Protection Authority in English), which is responsible for enforcing the law, including issuing penalties and fines. The creation of the ANPD was originally vetoed by President Jair Bolsonaro but later reinstated via [executive order](https://www.mondaq.com/brazil/data-protection/818496/provisional-measure-no-86918-creates-the-brazilian-data-protection-authority-and-amends-several-articles-of-the-brazilian-general-data-protection-law) in August of 2020.

## Who LGPD Applies To

LGPD applies to any organization (or individual) regardless of size, industry, public or private status, or country of residence.

Any legal entity or natural person processing data collected from persons in Brazil (“data controller”) is subject to LGPD if:

- The data collected/processed is about people in Brazil.
- The processing is carried out **inside Brazil;** or
- The processing is for the purposes of offering and selling goods or services to individuals in Brazil.
- The processing is of personal data collected within Brazil.

### Exceptions

There are some limited exceptions to the applicability of LGPD. Exceptions include situations where the data is being collected and/or processed:

- By a natural person for private and non-commercial purposes.
- For journalistic, artistic, or academic purposes, regardless of who does the collecting.
- For the purposes of national security, defense, or public safety.
- For investigating and prosecuting criminal offenses.
- If the personal data originates in other countries and only passes through Brazil without any processing being carried out.

## LGPD Includes a Broad Definition of Personal Data

[LGPD defines](https://iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/) personal data broadly as any information that could be used to identify an individual. This includes any information that could be combined with other information to identify an individual. That means information such as email, IP addresses, phone numbers, geolocation, and credit card numbers can all be considered personal information under LGPD.

### Sensitive Personal Data

Brazil has a culturally and racially diverse population. Like Europe’s GDPR, LGPD recognizes that additional protections are sometimes needed to protect individuals against discrimination. These potentially higher-risk attributes are defined as “sensitive personal data” under LGPD and include:

- Health information
- Genetic information
- Sexual information
- Medical information
- Biometric characteristics
- Racial or ethnic origin information
- Political affiliations
- Religious affiliations

## LGPD Compliance Obligations

LGPD is a significant enhancement and consolidation of Brazil’s previous data privacy laws, and the changes will affect organizations in every industry. Below are some of the key compliance considerations businesses will need to consider.

### 1. Define and Document Lawful Basis for Processing Personal Data

LGPD requires every organization that collects or processes personal data to have at least one of the following legally acceptable reasons for doing so, as well as to document those reasons for auditing purposes.

- **Consent from an individual to process their data.** Any individual over the age of 18 can consent to the processing of their personal data.
- **To follow applicable regulatory requirements and public policies.** Organizations can collect and process data if it is required in order to follow laws and regulations that apply to them.
- **For the purpose of conducting a study or research.** Research is a legal basis for personal data processing, as long as organizations take reasonable steps to anonymize that data.
- **To fulfill a contractual agreement.** Processing an individual's personal data is acceptable if you’ve signed a contract with that individual to deliver goods or services and need to process their data to provide it to them.
- **Legal proceedings.** Personal data may be processed for the sake of a court case, arbitration, or other legal proceedings.
- **To protect the life or physical safety of an individual or a third party.** For example, national security is a legally acceptable reason to process personal data.
- **To protect an individual’s health in healthcare procedures.** For example, it’s acceptable to process personal data to ensure you’re not putting a patient at risk during surgery.
- **For the legitimate interests of your organization or a third party.** Your organization’s interests are a legal basis for processing personal data, as long as those interests do not conflict with the rights, freedoms, or interests of an individual.
- **For the sake of protecting an individual’s credit.** Protecting an individual’s credit is an acceptable basis for processing data, as long as that processing is done in accordance with the provisions laid out in other relevant legislation in addition to LGPD.

### 2. Honor the Privacy Rights of Individuals

Like GDPR, LGPD provides individuals with several rights that they can request organizations to recognize and uphold at any time. Organizations must have internal procedures and processes in place to respond to requests from individuals who exercise these rights, which include:

- **Confirmation of processing.** Individuals have the right to confirm whether their personal data has been or is being processed.
- **Access to personal data.** Individuals may request access to any of their personal data that an organization processes.
- **Data portability.** Individuals may request that their personal data be transferred to another service or product provider, as long as that request is in accordance with other national regulations, doesn’t compromise any commercial or industrial secrets, and the data hasn’t already been anonymized.
- **Rectification of inaccurate information.** Individuals may request that inaccurate, outdated, or incomplete personal data be corrected or updated.
- **Anonymization, blocking, or deletion of data.** Individuals can request that unnecessary or excessive personal data, or personal data processed in a non-compliant manner, be anonymized, blocked, or deleted.
- **Deletion of data.** Individuals may request to have their personal data deleted at any time where processing is based on consent.
- **Right to be informed.** Individuals have the right to be informed about third parties granted access to their personal data. Individuals also have the right to be informed regarding their right to refuse consent.
- **Withdrawal of consent.** Individuals have the right to revoke their consent to process or collect data at any time.
- **Review of automated decisions.** Individuals have the right to request the review of decisions solely based on automated processing that affects their interests, including profiling.
- **Filing complaints.** Individuals may file a complaint against an organization with the ANPD if they feel that any of these rights have been violated.

### 3. Appoint a Data Protection Officer (DPO)

The LGPD requires every organization under its jurisdiction to appoint a data protection officer (DPO) to be their point person for data protection efforts. The DPO does not have to be an individual person; a committee can provide this service, as can an outside consultant. The DPO is responsible for ensuring that the organization takes appropriate action to protect personal data and for communicating with end-users and government authorities on matters related to data privacy. The identity and contact information of the DPO must be available to the public (preferably on your website).

### 4. Prepare, Inventory, and Conduct Data Protection Impact Assessments (DPIA)

To comply with LGPD, you must document the types of data you’re collecting, the methods used, along the steps taken to secure that data. You must also identify potential risks and document what you’ve done to mitigate them. Every organization that falls under LGPD’s jurisdiction should have these records on hand to show to a regulator upon request.

### 5. Follow Data Security Requirements and Data Breach Notification Protocols

Organizations must implement adequate organizational and technical controls in order to secure personal data from unauthorized access, deletion, alteration, sharing, or processing. In the event that a breach occurs that presents a risk or causes damage to individuals, organizations must notify the ANPD and individuals affected by the breach within a reasonable time period and include the following information:

- The type of personal data that was exposed and the individuals affected
- The risks associated with the exposure of that data
- The security measures in place to protect personal data (unless sharing this information would disclose industrial or commercial secrets)
- What your organization is doing to mitigate the effects of the breach on the individuals at risk

The ANPD may require an organization to take further steps, such as alerting the media about the breach or taking specific steps to mitigate the effects of the breach on affected individuals. These actions are assessed on a case-by-case basis.

### 6. Implement Privacy by Design

Like GDPR, LGPD requires organizations under its jurisdiction to design their data processing systems and procedures so that privacy is the default setting (the approach known as privacy by design) rather than adding privacy controls to those systems as an afterthought. Organizations should also be prepared to demonstrate the effectiveness of their data protection measures to the ANPD, as an audit could be conducted at any time.

### 7. Comply with Cross-Border Data Transfer Requirements

LGPD allows organizations to transfer protected personal data outside of Brazil if the laws of the country the data is transferred to provide adequate protection for that data. Adequacy of protection is determined by the ANPD. In the event that the protections offered by the receiving country are deemed inadequate by the ANPD, transfers may still be allowed if [certain conditions](https://iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/) are met.

## Penalties for Non-Compliance

Under LGPD, penalties for non-compliance are assessed by the ANPD and can include fines of up to 2% of a company’s annual revenue to a maximum of 50 million Brazilian reais per violation (approximately €7.5 million or $9M USD at the time of writing). The ANPD also has the authority to block access to or delete personal data from related databases and to partially or fully prohibit data processing activities in the event that a violation occurs. Additionally, the LGPD provides individuals with the right to seek civil damages for violations of their privacy, meaning organizations could face legal action from consumers in addition to fines assessed by regulators.

## Go Beyond Compliance

Regulations like LGPD and GDPR are landmark steps toward the protection of individuals’ right to privacy. But their similarities should also serve as a wake-up call to organizations everywhere that data privacy will require a lot more than plugging in a new set of controls for their existing systems in the future.

Instead, businesses should look to build privacy functionality into their systems from the outset, considering the well-being of the end-user rather than just the legal requirements. Not only will this help them earn the [trust of consumers](https://hbr.org/2020/01/do-you-care-about-privacy-as-much-as-your-customers-do), but it will also likely simplify the process of complying with new regulations as they emerge.

What Is LGPD? A Business Guide To Brazil's Data Protection Law

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

No organization or violation is too small to avoid costly penalties.



## No Organization or Violation Is Too Small to Avoid Costly Penalties.

Since the EU’s [General Data Protection Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr) took effect in May 2018, EU authorities have issued more than [370 million euros](https://www.itgovernance.co.uk/dpa-and-gdpr-penalties) in fines. The headlines about GDPR enforcement have been dominated by a few well-known companies hit with big penalties: $57 million for [Google](https://www.nytimes.com/2019/01/21/technology/google-europe-gdpr-fine.html), $123 million for [Marriott International](https://www.forbes.com/sites/kateoflahertyuk/2019/07/09/marriott-faces-gdpr-fine-of-123-million/), and $230 million for [British Airways](https://www.cnet.com/news/british-airways-faces-record-breaking-230m-gdpr-fine-for-2018-data-breach/).

If you’re an executive following these stories, you might walk away with the mistaken impression that European authorities are prosecuting only multinational corporations for massive data breaches or privacy violations. But authorities in EU member states haven’t hesitated to issue significant fines to smaller organizations, sometimes for seemingly minor infractions.

Broadly, EU data protection authorities can fine any organization (or private citizen) that collects or processes personal information of EU residents and fails to obtain appropriate consent, does not have an adequate legal basis for collection, does not have appropriate security in place to protect such data, or fails to comply with individuals’ right to access, alter, and delete their data.

Executives in the European Union and beyond can learn valuable lessons from these lesser-known GDPR fines. Here are a few particularly interesting cases of GDPR violations the EU authorities are pursuing, and ways your business can avoid being fined for noncompliance.

<include src="TweetQuote" quoteText="Doing business in the EU? Even if you’re not a Facebook or Google, there are lessons to be learned by the track record of significant GDPR fines for smaller companies."/>

## Dutch Insurers Hit With GDPR Fine for Not Using MFA
Dutch public insurance company UWV was penalized for neglecting to implement adequate security measures when processing health data. According to the [_National Law Review_](https://www.natlawreview.com/article/dutch-supervisory-authority-imposes-gdpr-security-standard-processing-broadly), UWV had a public portal where employers could submit the dates of employee absences due to illness, pregnancy, or parental leave. Though employers did not specify what medical situation employees missed work for, even alluding to the fact that someone had been sick still qualified this as “health data,” which is highly protected under the GDPR.

UWV was prosecuted under [Article 32 of the GDPR](https://gdpr-info.eu/art-32-gdpr/), which mandates that organizations “shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.” The Dutch supervisory authority deemed that UWV violated Article 32 by failing to implement [multifactor authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/) in its portal. With MFA, logins require an additional form of authentication, such as a one-time code or a biometric credential. This form of login is more secure than simple username-password combinations, which are vulnerable to improper access and [credential stuffing attacks](https://auth0.com/resources/whitepapers/credential-stuffing-attacks).

UWV is far from the only organization to be penalized for inadequate security. According to [GDPR Enforcement Tracker’s](https://www.enforcementtracker.com/#) database, there have been 37 fines levied to date under Article 32, making it the third-most-quoted article in enforcement actions, after articles 5 and 6. While 5 and 6 are quite broad in scope and could be considered catchalls, Article 32 singles out organizations with inadequate technical safeguards on personal data, whether that data was exposed or not.

UWV was made to conduct a privacy impact assessment and was given a year to put improved security in place, after which they would be fined €150,000 per month, with a maximum fine of €900,000.

**How to avoid this type of GDPR fine:** First, determine whether your business processes information that falls under one of the GDPR’s [special categories of personal data](https://gdpr-info.eu/art-9-gdpr/), which is defined as “data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership and the processing of genetic data, biometric data to uniquely identify a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.”

Any organization that engages in this type of data processing (even if, like UWV, it only obliquely alludes to it) will be held to a higher standard of data protection. That means it’s a good idea to put MFA in place to achieve GDPR compliance, and not just for your end-users but your employees as well. In a similar case in the Netherlands, a [hospital was fined](https://cloudprivacycheck.eu/latest-news/article/fine-of-EUR-460000-imposed-on-dutch-haga-hospital-by-dutch-data-protection-officer-the-first-dutch-fine-under-gdpr-july-19-2019/) €460,000 for not having two-factor authentication in place to prevent staff members from improperly accessing the medical records of a Dutch celebrity.

## Misplaced Files Earn a Hefty GDPR Fine

[Norway’s supervisory authority](https://aigine.se/en/one-file-in-the-wrong-place-price-170-000e/gdpr/) fined the municipality of Bergen €170,000 under articles 5 and 32 of the GDPR. This case came to light after a student in a local school discovered that several files, containing login credentials for 35,000 students and employees, were accessible to the public. This oversight was exacerbated by the fact that the school system also didn’t have MFA in place, so anyone who had login credentials could then access the school’s digital learning platform, which contained highly personal information, such as schoolwork and teacher evaluations.

Norway’s data protection authority, [Datatilsynet](https://www.datatilsynet.no/en/regulations-and-tools/reports-on-specific-subjects/administrative-fine-of-170.000--imposed-on-bergen-municipality/), said the size of the fine was partly due to “aggravating factors.” Specifically, they cited the fact that the majority of the data subjects were children, and that the town had been warned repeatedly, both by outsiders and “an internal whistleblower,” that it needed to improve its [data security](https://www.voicesage.com/blog/mobile-messaging-and-the-implications-on-data-security-best-practices/).

**How to avoid this type of GDPR fine:** As Datatilsynet explained in its decision: “In the GDPR, children are defined as a particularly vulnerable group that shall be given special protection.” So any business that processes the data of minors must exercise special care, both in ensuring that data is secure and in obtaining consent.

Also, this fine speaks to how imperative it is for every company to [get a clear view](https://auth0.com/blog/yes-data-privacy-applies-to-you/) of where their data is and who can access it. A good place to start is a user management system, with a [dashboard](https://auth0.com/docs/dashboard) that lets you easily grant and revoke permissions to sensitive data and delete it on request, by data subjects' rights under the GDPR.

<include src="TweetQuote" quoteText="The pace of GDPR is expected to pick up in 2020. Discover what even smaller companies need to do to avoid significant fines."/>

## Similar Data Breaches, but Very Different GDPR Fines

In the summer of 2018, German social media company [Knuddels](https://threatpost.com/knuddels-flirt-app-slapped-with-hefty-fine-after-data-breach/139384/) and EU fintech company [MisterTango](https://digitalguardian.com/blog/lithuanian-dpa-hopes-first-gdpr-fine-wake-call) each suffered data breaches that exposed personal information, but they were treated very differently by authorities.

Knuddels got away with a €20,000 administrative fine under Article 32, which [German supervisory authorities](https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-sein-erstes-bussgeld-in-deutschland-nach-der-ds-gvo/) attributed to its transparency, cooperation with authorities, and efforts to institute additional security measures.

MisterTango, meanwhile, was fined €61,500 under articles 5, 32, and 33. Lithuania’s data protection authority held the company to account for failing to report their security breach to the [Information Commissioner’s Office](https://ico.org.uk/)(ICO) within the requisite 72 hours. This initial misstep triggered an investigation, which revealed that MisterTango was collecting data with an insufficient legal basis and storing it for too long and had only one employee charged with handling data security.

**How to avoid this type of GDPR fine:** Both Knuddels and MisterTango made significant data security errors. Knuddels stored unencrypted versions of its users’ credentials, and MisterTango inadvertently exposed customer data in a public setting. There are lessons here about the importance of anonymizing personal information and keeping close track of data.

The biggest lesson, however, is in the vast disparity of the fines for two similar violations. Knuddels minimized the damage by coming forward about the security breach immediately and devoting adequate resources to ensure it would never happen again. [EU authorities have emphasized](https://auth0.com/blog/data-privacy-2019-the-lowdown/) that they will be more lenient with organizations that act in good faith and can show a commitment to fixing mistakes and prioritizing cybersecurity. By devoting adequate resources to data privacy—such as partnering with an expert third party like Auth0—you can prove that your business is serious about getting GDPR compliant.

## Embrace GDPR Compliance Now or Risk Penalties Later

What these fines should teach us is that no one who processes the data of EU citizens is small enough to pass under GDPR’s radar. (That even includes private individuals, like the man who was fined €300 by Austria’s data protection authority for [illegally using a dashcam](https://easygdpr.eu/gdpr-incident/strafe-gegen-privatperson-wegen-dashcam/).)

The pace of regulatory actions under the GDPR is expected to only increase in the coming year, and all it takes is a single individual’s complaint to trigger an investigation. Given the potential costs of GDPR infringement, along with the new data protection laws coming into effect around the world, now is the time to put appropriate security measures in place and prove that you’re serious about protecting personal information. If you’d like to learn how the right identity management partner can be part of the solution, don’t hesitate to reach out to [Auth0’s experts](mailto: sales@auth0.com) today.


GDPR Fines Hit These Companies Hard. Here’s How to Avoid Them.

jonathan-keen

I head up the legal function for Auth0 in the EMEA region (Europe, Middle East & Africa). I advise the business on commercial, IP, technology and data protection related legal matters - helping to ensure Auth0's interests are protected and that we remain ahead of the curve in a very dynamic legal and regulatory environment.

Associate General Counsel

Jonathan Keen

AWS, Auth0 set to invest in Kenya’s tech ecosystem


In March of 2019, the active number of [mobile subscriptions in Kenya stood at 51 million](https://ca.go.ke/wp-content/uploads/2019/06/Sector-Statistics-Report-Q3-2018-19.pdf), up from 49.5 million in the previous quarter (and over and above the country’s population of 47.6 million). By June, the Kenyan government allocated 12 billion shillings ($117.8m) to the [Konza Technopolis](https://www.konza.go.ke/) project, a world-class smart city with commercial and residential housing, a data center, and universities for science and information technology. 

Then, in November, Kenyan President Uhuru Kenyatta approved the country’s first data protection law. This is one of the most significant developments in the Silicon Savannah this year, protecting citizens online and further readying the Kenyan tech ecosystem for an opportunity. The move also shows that protecting private data is now considered a sign of global readiness. How ready? The Silicon Savannah tech ecosystem is [valued at over $1 billion](https://www.wired.com/story/kenya-silicon-savannah-photo-gallery/).

## Kenya’s First Data Protection Law

Kenya’s Information Minister Joe Muchero has stated the new data protection law complies with the [EU’s General Data Protection Regulation (GDPR)](https://auth0.com/gdpr/). In reality, such a claim has little practical meaning without a formal adequacy decision for the EU Commission, which currently remains a distant prospect until more detailed legislation is introduced. The law shares a lot of the same features as GDPR, including an independent office to investigate infringements and a maximum fine: 3 million shillings ($29,283) or two years in jail.

Like GDPR, the law governs how consumer data can be collected, shared, and stored. Reuters mentions companies like Kenya Airways, as well as the country’s hospitality and technology sectors will be among those that need to comply with the law.

Where there is data, there will inevitably be data misuse, and the East African nation is no exception. As Kenya’s digital ecosystem has grown, particularly the digital loan and payments market for which it is most widely known, so too have the reports of companies [collecting consumer data without consent](https://qz.com/africa/1712796/mobile-loans-apps-tala-branch-okash-face-scrutiny-in-kenya/) to make decisions about creditworthiness, etc. The new law provides more robust protection for Kenyan citizens from predatory and exploitative practices involving their personal data. 

## Attracting Tech Investment Like AWS

In addition to consumer protections, Kenya’s data privacy law aims to attract investment from other parts of the world in its burgeoning ecosystem. Already, Amazon Web Services ([AWS, and an Auth0 partner](https://auth0.com/learn/aws-auth0-iam-platform/)) has announced it will set up an ‘edge location’ in Nairobi, its first outside of South Africa.

Edge locations deliver content at the edge of the network to customers with lower latency connections. AWS has already established two of these locations in Johannesburg and Cape Town, and announced plans to open a data center in South Africa next year. The latter will give African companies more choice, and ultimately greater control over where personal information is stored and processed, a demand that is being driven by the continent’s nascent [data sovereignty](https://auth0.com/security/) requirements.

Auth0 is also making Kenya and Africa a focus area for 2020, delivering robust, yet simple identity management capabilities to entrepreneurs across the continent. Auth0 looks forward to leveraging its relationship with [AWS as its cloud infrastructure provider](https://auth0.com/resources/whitepapers/aws), to be able to offer African customers a more regional choice in respect to data center locations. 

## Setting the Standard for a Continent

Kenya’s law is the latest in a global movement toward [data privacy](https://auth0.com/explore/data-privacy/). All around the world, the proliferation of consumer data protection legislation is raising the bar for tech companies to design their products with privacy in mind. We expect Kenya’s startup ecosystem with its heavyweights like Safaricom M-PESA and solar energy company, M-KOPA, will embrace this challenge. When mobile subscriptions outpace the total population, investing in privacy is key to growth.


Kenya Passes Data Protection Law Inspired by GDPR

Breach protection isn’t enough — you need to prove trust with accreditation and data privacy respect


"As a CTO, I really don't want to be responsible for a data leak that showed passwords and user logins and those kinds of things. I'm 100% sure that Auth0, a company that is built around this, will have better ability to take care of the security than I'm able to do &mdash; your entire business depends on it," says Rolf Bekkstrand, former CTO, 4human HRM.

He's not alone.

No one wants to be the person who tried to save budget using a lesser level of encryption &mdash; and got hacked. Or, worse, [exposed customer data by storing it poorly](https://threatpost.com/facebook-data-of-millions-exposed-in-leaky-datasets/143412/).

In a broader sense, security is about trust. When your customers share their identity with you, they're trusting you to keep it safe &mdash; and while blogs posts and webinars can help convey that a third-party vendor is trustworthy, it's not enough for a company to just claim that it's secure. We need to prove it.

That need for proof has gone far beyond being a business requirement. GDPR's data protections may have come into force in 2018, but many countries already maintained strict requirements and others have data privacy plans in the works. All of this regulation is part of a global trend inspired, at least in part by the rising number of data breaches.

![Illustration for The Real ROI of Auth0, Part 3: Security](https://images.ctfassets.net/23aumh6u8s0i/24eCHY1wwRU8LJRrLT72iQ/868299ecb1a894525fe3b8169f2fa0eb/the-real-roi-of-auth0-part-3)

## Global Data Privacy Trends Include Civil Action

[Breaches](https://auth0.com/blog/what-is-a-data-breach/) are happening at such a rapid rate that USA Today now maintains a [ranked breach index](https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/). In the first half of 2018 alone, there were [668 breaches and over 22 million records exposed](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/).

According to the Ponemon Institute, the global average cost of a data breach rose to $3.86 million last year ([Forbes puts it at $7.91 million in the U.S.](https://auth0.com/blog/what-is-a-data-breach/)) &mdash; and those calculations are pre-GDPR. With [€50 million in non-compliance fines leveled at Google](https://www.bbc.com/news/technology-46944696), a [suit already filed against eight other companies including Apple and Amazon](https://www.darkreading.com/privacy/gdpr-suit-filed-against-amazon-apple/d/d-id/1333690?_mc=NL_DR_EDT_DR_daily_20190119&cid=NL_DR_EDT_DR_daily_20190119&elq_mid=88915&elq_cid=25956827), and an [EU judge ruling that civil action against Facebook is viable](https://tech.newstatesman.com/business/schrems-facebook-legal-battle), security and compliance are about much more than your perimeter.

Lest you think that these concerns only apply to your EU customers, the shift towards protecting data privacy is a global trend, but one where different countries might use GDPR as a baseline, but tweak it for their needs. A case in point is California's data privacy law, coming into force in 2020, which looks likely to provide [the basis for a Federal data law in the U.S](https://digitalguardian.com/blog/lawmakers-see-california-consumer-privacy-act-basis-federal-law). You can find in-depth look at expected data privacy trends in 2019 [here](https://auth0.com/blog/data-privacy-2019-the-lowdown/).

The likelihood that data has been exposed is part of the reason behind all the regulation, but due to the rising number of data breaches, it's no longer just companies and partners that want to be protected, says John McKim, VP of Product & Technology, [A Cloud Guru](https://auth0.com/learn/cloud-guru-saves-550000-aud-annually-using-auth0/), "Customers want to know that their data is going to be protected and secured, and identity is a critical part of that. Having confidence that the systems that hold their very personal information... is really critical. That's why we like to use Auth0."

## Proving Trust with Accreditation

<iframe width="560" height="315" src="https://www.youtube.com/embed/FySg3K4HXAs" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

Accreditations are often on a required term-of-business checklist, but the reasoning for that placement lies in trust, says Auth0 CISO/VP of Operations Joan D. Pepin. "That certification means an external third-party has verified that we meet a professional standard &mdash; and it's not a one-and-done effort. We have to work to maintain that accreditation. Just as you need to regularly update the software on your laptop, we need to continually update our security."

This continuous improvement and monitoring happen alongside our development efforts, helping us to continue building in security as we innovate.

Companies who choose Auth0 instead of building identity in-house benefit from our accreditations.

Certifications like [SOC 2, HIPAA, and ISO 27001](https://auth0.com/security/) require an upfront investment to achieve the accreditation plus yearly costs to maintain it. "Most Fortune 500 companies won't sign deals if you don't have the applicable certifications," says Auth0 Senior Manager of Governance Risk and Compliance Adam Nunn. "Yearly tooling costs can vary from organization to organization, ranging from $25,000 to multi-millions, depending on the size of the org."

Auth0 invests yearly on third-party auditors, salaries for the staff who make sure we're compliant, and internal compliance tools (excluding engineering tools and/or tools deployed for security purposes), and continually improving our processes &mdash; eliminating both certification worry and cost for our customers.

For companies protecting large amounts of sensitive and regulated data, like healthcare collaboration platform [ACT.md](https://auth0.com/learn/act-md-sees-2x-dev-savings-auth0/), realizing it doesn't have to be painful can come as a surprise.

"We hadn't expected to be able to find a partner like Auth0 who would be so focused on security, proper authentication, and yet create a platform that's incredibly well-documented, easy to test, and is HIPAA compliant," Narath Carlile, Chief Medical Information Officer, ACT.md.

## Getting the 'Jump' on Fraudulent Users

Working with identity experts means dealing with fewer bugs, vulnerabilities, and introduced workarounds, but active security features like anomaly detection and brute force protection can remove a significant amount of worry for your and your customers &mdash; even if you're doing business in a challenging space.

"Marketplaces can be a heavily fraudulent space. A lot of scammers list fake cars and they have different mobile numbers and email addresses or whatever, and they try to convince people to wire transfer money,"  says former Cox Automotive Australia CTO Jeremy Gupta. Instrumenting Auth0 in the private seller experience allows Autotrader to verify mobile and email using out-of-the-box flows plus customization.

"We also get some really strong moderation through the Auth0 platform, which allows our customer service team to jump on fraudulent users ahead of time," says Gupta.

## Security ROI

"I'm a big proponent of letting experts do what they do best. If you get identity management wrong, it falls apart horribly, and you get put on the front page of the newspaper as having exposed a large number of people to really bad things. I didn't want to rely on building it ourselves," David Bernick, former Director of Cloud and Technology, Harvard Medical School

Since we control the front door to our customers' applications, we are a security company. Auth0 takes protecting our customers identity transactions seriously. "We invest heavily in our Security team, building out a cutting edge program and hiring talented engineers who want to build the security of a security company," says Auth0 Senior Director of Security Duncan Godfrey.

That behind-the-login-box effort pays off for our customers. "Security is often misunderstood, and when it is an afterthought, left to the end, it tends to bite you in the butt.," says Stephen Berard, former Senior Global Software Architect, Schneider Electric. "We didn't have to kick the proverbial can down the road every time a new security or authentication question came up, whether the question was hypothetical, practical or mission critical.

## Resources

**The Real ROI of Auth0**
[The Real ROI of Auth0, Part 1: Time To Market](https://auth0.com/blog/the-real-roi-of-auth0-part-1-time-to-market/)<br> 
[The Real ROI of Auth0, Part 2: Innovation](https://auth0.com/blog/the-real-roi-of-auth0-part-2-innovation/)<br> 
The Real ROI of Auth0, Part 3: Security (you're reading Part 3)<br> 
[The Real ROI of Auth0, Part 4: Maintenance](https://auth0.com/blog/the-real-roi-of-auth0-part-4-maintenance/)<br> 

**Guidance**: [Auth0's Approach to Information Security](https://auth0.com/resources/whitepapers/auth0-security/) details our approach to information security and our list of certifications and compliance capabilities so that you can better understand how Auth0 protects your data.

**Docs**: Customers often cite the benefit of our clear documentation and Jumpstarts. Get started [here](https://auth0.com/docs/).

**Questions?** Please reach out to an [Auth0 Resource](mailto:sales@auth0.com) if you'd like to learn how we can support your specific project or digital transformation.


The Real ROI of Auth0, Part 3: Security

story-tweedie-yates

Story is a Sr. Director of Product Marketing at Auth0, where she is passionate about the value of identity in the applications you build. With an eclectic background in psychology, professional athletics and cybersecurity, her expertise lies in working deeply with analysts, sales and customers to uncover the significance of security and identity to customers’ biggest business problems. Story is a Stanford graduate with a BS in Psychology. She also has an MBA from Thunderbird School of Global Management, speaks fluent Spanish and has done business in over 40 countries. In her time off, you will find her scooting her twins around the town or exploring underwater treasures with a scuba mask alongside her husband.

Sr. Director Product Marketing

Story Tweedie-Yates

We demystify 7 common misconceptions about GDPR. Make sure you are informed about data protection and GDPR compliance requirements.



 <div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR is around the corner. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

Did you feel like you had a clear direction for your business when it came to customer experience, acquisition, and the competitiveness of your services and apps... but then [GDPR](https://auth0.com/gdpr) came around and now everything has a giant question mark in front of it? If you are confused about how to move forward, you are not alone.

![GDPR - General Data Protection Regulation](https://images.ctfassets.net/23aumh6u8s0i/1TWFcNwmXWjBsj2kZUcYiB/9b7cf20f83478bafa60b8a7f4cfbf73f/gdpr-flag)

We've deciphered seven recurring misconceptions we hear from customers regarding GDPR and identity for the apps they build. Your mission here, should you choose to accept it, is simply to read the reality.

<include src="TweetQuote" quoteText="We've deciphered seven recurring misconceptions we hear from customers regarding GDPR and identity for the apps they build."/>

## Misconception #1: An identity vendor can make you GDPR compliant.

If we put all our user data in Auth0's platform, all things GDPR (not just Identity-related) are covered and your liability is now Auth0's liability.

### Reality:

No identity vendor can make you GDPR-compliant. Not even Auth0.
As the entity controlling what happens to the personal information—collecting the data, providing notifications, and obtaining consent—you're ultimately responsible for compliance. Making sure that your vendors (like Auth0) are compliant is part of your GDPR requirement process, but vendor compliance doesn't shift your liability to the vendor.

<include src="TweetQuote" quoteText="No identity vendor can make you GDPR-compliant. Not even Auth0."/>

The relationship with an identity vendor is in terms of the two levels of data responsibility for GDPR compliance, classifying you as either a data owner or a data controller.

If you're using Auth0, you're the data controller and we (Auth0) are the data processing providers. ([More on data controller/data processor responsibilities can be found here](https://www.gdpreu.org/the-regulation/key-concepts/data-controllers-and-processors/).)

An identity vendor like Auth0 can make your GDPR efforts easier by helping secure, track, and update consent at login, as well as gaining a consistent view of user identities.

## Misconception #2: The best way for your users to stop receiving unwanted emails is to enact the [right to erasure](https://gdpr-info.eu/art-17-gdpr/).

### Reality:

GDPR makes it critical for you to understand what your customers really want.

There will be times when your customer really wants you to erase all their data. And times when they just want you to stop sending them email. And times when the customer really wants to stop receiving 3rd party 'partner' emails (spam) but wants to continue receiving useful emails from you.

If your customer wants to stop all marketing emails or just third-party emails, they can [enact the right to object](https://gdpr-info.eu/art-21-gdpr/). You'll stop the communications, but retain approved data.

The right to erasure is more complete. When you erase all of the data, the customer's opt-in/opt-out preferences also go away, which means that at some point in the future, they might give you personal information which could put them back into the pool of customers who regularly receive your emails—exactly what they might have been trying to avoid with 'erasure.'

Making the distinction between the right to erasure and the right to object clear for your customers can get them what they really want.

Auth0 can help you easily track and provide granular consent options at sign-in to exclude marketing emails. For customers who want to change their consent after login, you'll need to decide where you would like to locate granular consent options within your application.

## Misconception #3: Social login will raise compliance issues by capturing too much customer information.

### Reality:

We've found that social logins reduce user friction and enable conversions. Under GDPR your can only request the information you need to provide your service, whether you get that information directly from the customer when they fill in the fields in your forms, or from Facebook, Twitter, or another social login.

You can quickly review a social provider's external-facing web pages to learn what user information they provide at login and determine whether or not it's necessary for your business services.

Here's what's available from some of the most popular providers accessed by our customers:

* [LinkedIn](https://developer.linkedin.com/docs/fields/basic-profile#)
* [Facebook](https://developers.facebook.com/docs/facebook-login/permissions#reference-public_profile)
* [Google](https://developers.google.com/identity/sign-in/web/reference#googleusergetbasicprofile)

Auth0 offers a simple checkbox to easily control the data you collect from social vendors like LinkedIn, Facebook, and Google, making it easier to comply with GDPR's 'data minimization' requirements.

## Misconception #4: If you have an on-premises deployment for identity, this will automatically help you achieve GDPR compliance.

### Reality:

An on-premises deployment of identity for the apps you build will not automatically help you achieve GDPR compliance. What matters fundamentally is how that data is processed. For example:

* If you have an on-premises deployment but you are still putting data into that on-premises device that is above and beyond what is required for the purposes of your business, you will still have a GDPR compliance issue.
* If your users' data is on-premises but it is stored across multiple instances and you don't know what is where, you might have difficulty gaining explicit consent for your users across all the apps they are accessing. You might have consent from one application but not the other.

There is nothing innate to GDPR that says having an on-premises deployment will make you compliant. For more information about what it means to [process personal data, according to GDPR, see Article 4](https://gdpr-info.eu/art-4-gdpr/).

## Misconception #5: If you are using a cloud instance that is hosted in the EU for the purposes of processing EU users' personal data, this will help you comply with GDPR.

### Reality:

Having a cloud instance in the EU will not help you comply with GDPR if that data is then being processed outside of the EU.
The key is to pay attention to where the processing of the data is taking place, not where the data center is hosted.

## Misconception #6: If you are already certified with privacy shield, you are ready for GDPR.

### Reality:

[Privacy Shield Certification](https://www.privacyshield.gov/welcome) is a great start, but there are some significant differences between GDPR and privacy shield.

For example, you're going to need to do some additional work on the 'right to erasure' for foreign processing of EU residents' data as well as making sure you've met Data Protection Officer and breach notification requirements. Other differences include [fines](https://resources.auth0.com/whitepaper/gdpr-fine-determination/) and possible timing around responses to data 'subject access requests'.

## Misconception #7: Shouldn't my legal team be able to tell me exactly how I can achieve compliance?

### Reality:

It is very possible that your legal team does not yet have an opinion on how to interpret the GDPR regulation. There are currently no court cases testing interpretation, ambiguities, or inconsistencies between GDPR and other regulations, or even an audit that can show you whether or not you are compliant.
That being said, the best route is to regularly consult with your privacy officer and legal team so you can chart a path toward GDPR compliance together.

The European Union (EU) also has an advisory body that provides expert advice on data protection matters. Official GDPR guidance from the Article 29 Working Party (WP29) can be found here, or get in touch with your legal counsel.

We've also found drawing on experts in the field to be extremely helpful.

## Is your IAM ready for GDPR?

Mission Complete! Neither you nor this message will self-destruct. Now you're ready to take the GDPR identity assessment to see where you stack up and where you might need to make improvements on the path to [GDPR compliance](https://auth0.com/gdpr-assessment/).

What misconceptions have you heard? Do you have any questions you would like us to help with? Let us know in the comments below and help other people benefit from the reality!


Mission Possible: Reality for 7 GDPR Misconceptions

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

DPM, a Microsoft tool, lets you back up various forms of enterprise data in real time.



After the February 1st, 2017 Gitlab incident, in which six hours of production data were accidentally deleted, the importance of making and maintaining adequate system [backups became very clear to the world](https://about.gitlab.com/2017/02/10/postmortem-of-database-outage-of-january-31/).

As we saw in that incident, a lot of companies make backups. What they seem to forget is that backups are just one part of the equation. It's equally important to consider how those backups will be accessed during an outage, whether it will be possible to restore them in a timely fashion, and what tests need to be consistently run to ensure adequate restore.

If you work within a Microsoft ecosystem, then Data Protection Manager (DPM) is a powerful option for creating and managing backups of all of your data.

### How DPM Works

You can configure DPM to back up your folders and volumes, create full system backups, initiate backups of workloads like SQL Server or Exchange, backup entire Hyper-V virtual machines, and more. Information can be backed up to disk, tape, or to the Microsoft Azure cloud:

- **Disk-based:** In DPM's disk-based protection, a copy of your data is generated, stored, and regularly refreshed on the DPM server. Separate copies are made and maintained for different data sources such as database instances or volumes from a server cluster.
- **Tape-based:** DPM also offers tape-based backups, and though it is mainly intended for long-term storage (where it's combined with disk-based backups for the short-term), you can back up your data primarily to tape.
- **Azure-based:** Whether you deploy DPM as a physical server or Azure virtual machine, you can back up your data to an Azure Recovery Services vault as an alternative to long term tape-based protection.

In the event of a disruption, DPM allows you to immediately restore all of that data.

### Best Use Case Scenarios for DPM

If you're a small business with just one office, or you're backing up volumes that are rarely on-premises, then a more simple, scaled-back solution like Azure Backup agent might be [right for you](https://docs.microsoft.com/en-us/azure/backup/backup-introduction-to-azure-backup). Azure Backup supports backups of both files and folders, but it won't back up VMs, applications, or workloads.

The following kinds of data and workloads can be backed up using DPM:

- Files
- Folders
- Volumes
- Hyper-V VM (Windows)
- Hyper-V VM (Linux)
- Microsoft SQL Server
- Microsoft Sharepoint
- Microsoft Exchange

([Source](https://docs.microsoft.com/en-us/azure/backup/backup-introduction-to-azure-backup))


Microsoft has also put out a slightly less scaled-back version of DPM, [called Azure Backup Server](https://4sysops.com/archives/microsoft-azure-backup-server-mabs-vs-data-protection-manager-dpm/). It's a available for free when you download Azure Backup. Azure Backup Server also offers backups of workloads and other data sources, with some key differences:

- Tape-based protection is only offered with DPM
- DPM allows redundant backups—where you can protect one DPM installation with another
- DPM will also perform recovery of Hyper-V replicas—Azure Backup Server will only do the backing up

Your choice of backup system should track with your needs:

- **I just need to backup files and folders**: Azure Backup agent
- **I need to back up more than files and folders:** Azure Backup Server
- **I need all-in-one management, tape-based protection, and better redundancy:** Data Protection Manager

### Aside: How We Do Backups at Auth0

We have designed Auth0 from the bottom-up to ensure that we can keep serving our customers in the event of any disruption or threat:

- **Infrastructure:** We use SaaS tools and hosts that offer redundancy, so an outage at a single data center or a single disk failing won't affect the continuity of our customers' services.
- **Personnel:** Our staff is distributed all around the world, capable of responding to any problem remotely, and all staff is cross-trained to ensure that there's always someone around that can respond to a threat.
- **Data Storage:** All critical data is stored in the cloud where it is subject to redundant backups. A rigorous testing schedule ensures that all of our backup procedures themselves are operating correctly.

The risk of system failure is always with us, which is why we've worked hard to mitigate that risk through these practices.

![How DPM works](https://images.ctfassets.net/23aumh6u8s0i/3ZUjImSskjBdoSUeoMQdrZ/361224d289fc4f80e945140f5db12db3/auth0)


How Data Protection Manager (DPM) Works

jonathan-armstrong

Guest Author

Jonathan Armstrong

The data protection and security landscape is all set for change next year with the new EU General Data Protection Regulation (GDPR). Find out how this may affect your business and what to do next.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR is around the corner. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

## Introduction

The data protection and security landscape is all set for change next year with the new [EU General Data Protection Regulation (“GDPR”)](https://auth0.com/gdpr). There will be regulatory burdens, but you can also use GDPR to bring some focus on what you do and improve your security stance.  Remember...

* The new rules are part revolution/part evolution - the new system builds on the current one if you already comply with EU privacy laws you can build on those foundations;
* Don’t panic, plan instead - the full impact will come in 2018 but preparation now will pay off then.

![EU General Data Protection Regulation](https://images.ctfassets.net/23aumh6u8s0i/1TWFcNwmXWjBsj2kZUcYiB/9b7cf20f83478bafa60b8a7f4cfbf73f/gdpr-flag)

At Cordery we’ve been working on GDPR projects since the first draft came out in 2012. GDPR is a long document but here’s some highlights:

## Reach

The new rules will apply to all those in the EU who control data and/or undertake data processing.

* All sectors are affected - the more robust your privacy compliance the better your market advantage;
* Non-EU businesses doing business in the EU are also affected.

Identity management has a role to play in GDPR to help you work out whether data subjects are who they say they are and whether they are in scope for different aspects of GDPR. Establishing identity is also essential when someone tries to exercise new rights which GDPR creates.

## What are those new rights?

New rights are being introduced and existing ones tweaked, including.

* A new Right To Data Portability;
* An extended Right To Be Forgotten (called the Right to Erasure);
* An enhanced Subject Access Right - to be free and with a shorter time to reply.

## Data Protection Impact Assessments ("DPIAs")

DPIAs will have to be undertaken for certain data processing operations.

DPIAs put the compliance assessment burden on those handling personal data - but, used as a wider tool they help you get a better handle on your data processes and reduce risk. This should help you build privacy and security into the heart of what you do. There’s no set format - the key thing is to pick a process that is simple to understand and helps you get to the real risks quickly.

### Security Breach Reporting

One of the most important changes is that there will be mandatory security breach reporting.

Breaches must be reported to a regulator within 72 hours and those affected by the breach must also be informed - to do this you must have clear, practical, effective and immediate procedures. You’ll also need to get your vendors and suppliers on board - this is business critical so you can’t afford to get it wrong.

### Greater Penalties

Increased enforcement will come about with the new regime, backed up by [greater sanctions](https://resources.auth0.com/whitepaper/gdpr-fine-determination/).

There are fines of up to €20 million or 4% of the global annual revenue of a business (whichever is the greater), with likely higher reputational damage resulting and the possibility of civil actions too. This is the big stick for data protection compliance, but, getting it right will avoid major headaches.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

## What you need to do now?

Start preparing now and read our FAQs at [www.bit.ly/gdprfaq](https://www.bit.ly/gdprfaq) or watch our film on YouTube at [www.bit.ly/gdprfilm](https://www.bit.ly/gdprfilm). You might also be interested in our GDPR subscription service which includes films, checklists articles and a monthly call to help plan for GDPR. The details of this service are at [www.bit.ly/gdprnav](https://www.bit.ly/gdprnav).

<div class="alert alert-info">
<strong>About Jonathan Armstrong:</strong><br />
<p style="color: #097093;">Jonathan is an experienced lawyer with Cordery in the UK with a concentration on compliance and technology. His practice includes advising multinational companies on matters involving risk, compliance and technology across Europe. He has handled legal matters in more than 60 countries involving data breach, bribery and corruption, corporate governance, ethics code implementation, reputation, internal investigations, marketing, branding and global privacy policies.</p>

<p style="color: #097093;">Jonathan is one of three co-authors of the LexisNexis definitive work on technology risk, "Managing Risk: Technology & Communications". He is a frequent broadcaster for the BBC and other channels.</p>

<p style="color: #097093;">Jonathan was ranked as the 14th most influential figure in global data security by Onalytica in their 2016 Data Security Top 100 Influencers and Brands Survey.</p>

<p style="color: #097093;">In addition to being a lawyer, Jonathan is a Fellow of The Chartered Institute of Marketing. He has spoken at conferences in the U.S., Canada, China, Brazil, Singapore, Vietnam, Dubai and across Europe. Jonathan qualified as a lawyer in the UK in 1991 and has focused on compliance and technology matters for more than 20 years.</p>
</div>


"data protection"