Become GDPR Compliant with Twake

What is GDPR?
What is personal data?
Who is impacted by the GDPR?
What are the requirements of GDPR?
GDPR & Twake
What does Twake do to ensure full compliance with GDPR?
How can Twake help your organization to comply with the GDPR?

1. What encryption technologies are utilized by the provider?

While the GDPR does not mention encryption methods specifically, the way encryption keys are stored is critical in determining if re-identification of individuals from the leaked encrypted material is achievable with reasonable amount of effort. With in-transit and at-rest encryption, Twake offers maximum security to the personal data of its users. We have also included endto-end encryption in our short-term roadmap to provide iron-clad security to our users and their personal data.

2. What other security and control options does the service provider provide?

Beyond robust encryption, the supplier must take additional precautions to protect their users’ data. Account security should be treated seriously first and foremost. This includes securely managing user authentication, ideally using zero-knowledge approaches. There are many levels of security when it comes to how a service provider handles your password. The “zeroknowledge” method provides the maximum level of password security: your provider has no knowledge of your password. Your password will not be compromises in this instance if the service provider is hacked or if an employee leak occurs. According to surveys, employee errors or malicious workers account for a major part of data breaches. These occurrences might include lost or stolen work devices, as well as intentional data leaks by personnel. To reduce the dangers of these incidents, make sure your provider has robust data control and governance capabilities. You should look for the following features: Permission management, including the ability to set granular access levels to personal and other sensitive data, as well as the ability to monitor staff activities related to file management, such as those who opened or deleted files (audit trails), and the ability to create and monitor internal security policies related to data security, and backup options such as deleted file recovery, and device control tools.

3. Is the supplier upfront about where the data is stored and how it is protected?

Personal data must be processed lawfully, fairly, and transparently, according to the GDPR. This is true for companies that manage personal data (data controllers) as well as the cloudbased services they use (data processors). The data controller, on the other hand, must ensure that the third-party services they utilize meet these rules, as they bear the ultimate responsibility and obligation for data protection under the principle of accountability. The controller should be able to demonstrate that all the principles governing the processing of personal data have been followed. Aspects such as data residency are also critical. Although the GDPR does not specify whether the data should be stored in the EU, if your supplier maintains your data in EU datacenters, GDPR compliance will be easier. Additional guarantees are required when the provider employs third-country datacenters or sub-processors to ensure that your data is protected to the same high standards that the GDPR mandates in the EU.

4. Is the company able to produce legally binding data protection documents?

The GDPR streamlines data protection legislation across all EU member states to provide EU residents more control over the privacy of their data. This means that all businesses who handle the personal data of EU citizens must follow its stringent guidelines. If you are looking for a cloud solution provider situated in the EU (for example Twake is located in France and so are our servers), look for evidence that the company has begun to prepare their data management systems for the GDPR. This includes, among other things, providing the appropriate data protection documentation, such as a clear and easy-tounderstand Privacy Policy and Terms of Use, as well as a Data Processing Agreement that their business clients can sign. If the cloud provider is not based in the EU, you will need to look for additional evidence. Ascertain if the company is based in a country that has received a European Commission data protection adequacy ruling or provides other acceptable contractual guarantees that establish, they have the same high level of protection as EU Companies (for example, Standard Contractual Clauses adopted by the European Commission, or Binding Corporate Rules (BCRs) approved through the method specified in GDPR Article 47.

5. How does the company demonstrate that the aforementioned procedures are followed?

The GDPR is revolutionary because it takes a risk-based and by-design approach to data protection and privacy. Companies must analyze the risks associated with personal data management and take necessary technical and organizational measures to mitigate them. They must also be able to demonstrate that they took the essential precautions in light of the dangers. This is true for whatever cloud provider you are considering. Despite the fact that the GDPR is a new regulation, you can ask for further data protection agreements.