Oracle GDPR: Can Oracle Solutions Help You Comply with GDPR?
Nick Sorenson
July 29, 2021

How Does Oracle Help You Comply with GDPR?

The General Data Protection Regulation (GDPR) is a regulation that protects the private data of European citizens. It applies to all private data related to the European Union (EU), regardless of whether the entity is located within or outside the EU. 

To ensure the protection of personal data, GDPR requires that entities collecting sensitive data handle it in certain ways and implement security measures that protect private data and provide individuals with control over their data.

Enterprise Resource Planning (ERP), Customer Relationship Management (CRM), and Human Resource Management (HRM) solutions store a wealth of sensitive customer data.  Software providers like Oracle often help their customers comply with the GDPR, by providing controls that organizations can use to implement privacy and security requirements. 

Oracle ERP, CRM, and HCM are designed with security in mind, offering a variety of compliance features including access controls, data encryption and masking, keys management, labels security, intelligent monitoring and auditing, and enterprise-grade cloud management.

This is part of our series of articles about Oracle cloud security.

In this article, you will learn:

How Does the GDPR Relate to Databases and Information Systems?

Here are several ways the GDPR impacts databases, ERP, CRM, and HCM applications:

  • Data security—to comply with GDPR, organizations are required to implement organizational and technical security controls. These measures should help prevent information leaks, data loss, and any unauthorized operations of data processing. To achieve these goals, GDPR requires the use of several security techniques and tools, including incident management and encryption. Additionally, organizations should introduce network and system resilience, availability, and integrity into their overall security.
  • Extended rights of individuals—GDPR requires organizations to ensure individuals have greater control and ownership of their data. GDPR created an extended set of rights dedicated to data protection, such as the right to be forgotten and the right to data portability.
  • Data breach notification—once organizations learn of a breach, they must inform their regulators and impacted individuals. GDPR requires that organizations inform relevant parties in due haste. 
  • Security audits—companies are expected to document and keep records of their organizational security practices. GDPR also requires that organizations audit the effectiveness of security programs and take corrective measures when needed.

Oracle Security Solutions and GDPR

Here are several Oracle features that can help organizations comply with the GDPR:

  • Discovery—Oracle offers cloud-based services and on premises products designed to help organizations map the flow of data and identify sensitive data that might be subject to regulation. These offerings come with capabilities for data governance including asset inventory, data discovery, and data lineage.
  • Enrichment—offers capabilities for modifying applications to comply with data rights. As needed, this feature can help consolidate customer data across the organization into a single view.
  • Enforcement—Oracle offers hybrid cloud technologies designed to enforce security controls and policies that can help protect data from unauthorized viewing or downloading.

Here are several security measures supplied by the enforcement feature of the Oracle solutions framework:

  • Data protection—Oracle offers encryption for data-at-rest and data-in-transit. The goal of encryption is to prevent unauthorized access. It is generally considered a strong preventive measure and also has the advantage of being transparent to users and applications. This usually translates into low performance impact on modern solutions. Oracle offers more data protection features, including encryption keys management, data masking, and application layer data redaction.
  • Access controls—Oracle provides access and identity management capabilities designed to help organizations control who and what has access to data. Typically, these access controls hinge on roles, which require specific customization depending on each business environment.
  • Monitor, block and audit—Oracle offers automated and intelligent monitoring solutions, which can help in the collection and analysis of external and internal threat feeds as well as logs. The goal is to help detect and mitigate threats in real-time, so data can be protected before it is breached. 
  • Secure configurations—Oracle provides features for secure configuration management, which can help organizations maintain security hygiene. Organizations can use this feature to ensure their software is continuously updated, patched, and properly configured. This can help prevent cyber criminals from exploiting vulnerabilities in unpatched software to access sensitive data.

How Oracle Security Products and Features Can Help Address GDPR

Oracle offers a variety of premises and cloud-based security features, which can help organizations protect data, audit and monitor their IT environments, and manage user identities. 

Here are several data protection features:

  • Oracle Advanced Security—offers transparent encryption for Oracle databases, including redaction of sensitive application data.
  • Oracle Key Vault—provides secure management of the encryption key lifecycle, including passwords management and certificates.
  • Oracle Data Masking and Subsetting—helps organizations anonymize production data, for use in development and testing environments.

Here are several access control features:

  • Oracle Database Vault—enables organizations to control access to privileged user accounts, using enforcement of segregation of duties (SoD) as well as least privilege.
  • Oracle Identity Governance—lets organizations manage the lifecycle of identities, including role definition, management of privileged accounts, identity intelligence, and user administration. 
  • Oracle Access Management—offers protection for IT assets and identity federation designed for several use cases.
  • Oracle Unified Directory—helps organizations manage large user directories with fast read-write to provide centralized user management.
  • Oracle Label Security—enables organizations to label individual data records with metadata describing data characteristics. Access to these records is then enforced according to the metadata.

Furthermore, there are several features Oracle offers for monitoring, auditing, and compliance:

  • Oracle Audit Vault and Database Firewall—centralizes the reporting, alerting, monitoring, and auditing of anomalous database activities.
  • Cloud Infrastructure Security—helps organizations detect unauthorized cloud services and implement security policies across authorized environments, including SaaS, IaaS, and PaaS.
  • Enterprise Manager Cloud Control—enables organizations to verify that their IT assets are properly and securely installed and configured.

Oracle GDPR Compliance with Pathlock

Protecting sensitive data in Oracle applications like Oracle EBS, PeopleSoft, Siebel, and others is a mission critical task for any businesses storing large volumes of customer or employee data. 

Pathlock provides a comprehensive solution for protecting all Oracle applications, including:

  • With Pathlock Control, customers can secure access to all of their Oracle and non-Oracle systems, whether hosted in the cloud or on-premise. 
    • Pathlock provides Emergency Access Management to manage privilege elevation across systems
    • Pathlock provides Role Based Access Control to control access to sensitive data objects and systems
    • Pathlock provides Separation of Duties functionality to ensure data cannot be exported in mass easily
    • Pathlock provides User Access Reviews to ensure overprivileged and zombie accounts are not used as a vector for data exfiltration
  • With Pathlock Control Premium, customers can monitor all activity across their Oracle applications
    • Pathlock provides monitoring of IT General Controls for zombie accounts, failed logins, passwords requiring reset, and more
    • Pathlock tracks changes to application configurations and master data to ensure loopholes are not created and companies stay compliant
    • Pathlock monitors all access and changes made to sensitive data, to provide reporting against compliance frameworks like GDPR
  • With Pathlock Control 360, customers can extend their Role Based Access Control to Attribute Based Access Control, providing fine grained data masking and encryption to provide greater protection than broad roles can provide on their own
    • Pathlock discovers sensitive data living in any Oracle Applicaitons
    • Pathlock can create custom rules to encrypt sensitive data to ensure it is not accessed by unauthorized users

Interested to learn more about how you can enforce Oracle GDPR with Pathlock?  Request a demo of our industry leading capabilities today!