Standards and compliance

1. Overview

In the context of data registries, where valuable information is collected, processed, and maintained, the significance of robust regulations and data privacy measures becomes paramount. Data registries serve as critical repositories of confidential data, ranging from personal records to vital statistics, making adherence to data protection regulations a vital ethical and legal imperative.

The document underscores the fundamental role that data privacy and regulatory compliance play in safeguarding the integrity, confidentiality, and accessibility of the information entrusted to the Registry Platform.

2. Applicable regulations and standards

The Registry platform has been developed according to Ukrainian national standards and data privacy laws. It holds the Certificate of Compliance of Comprehensive information protection system (The Ukrainian term 'КСЗІ' stands for 'Комплексна система захисту інформації'). It is the result of a state examination in the field of technical information protection.

The Registry Platform complying with key concepts of the Ukrainian Personal Data Protection Law.

While aligning of technical controls with Ukrainian Personal Data Protection Law, The Registry Platform also has the potential to extend its compliance to the GDPR-ready state, as many of the key concepts and requirements overlap.

Data protection principles, such as lawful processing, data minimization, and accountability, are integral to both Ukrainian and EU data protection laws. The platform’s potential to become GDPR-ready signifies its dedication to meeting high data protection standards, extending its commitment to users' privacy and security beyond national borders.

Addititonally The Registries Platform is developed following the next security standards:

  • The software security posture management acording to OWASP Software Assurance Maturity Model (SAMM).

  • The OWASP Application Security Verification Standard (ASVS) Project as a basis for testing web application technical security controls and source of requirements for secure development.

  • Center for Internet Security Software Supply Chain Security Guide (CIS SSCS) as a basis for supply chain security

3. Scope of compliance

The Registry Platform is subject to compliance with mentioned regulations and standards to ensure the secure and lawful handling of user data. This section defines the scope of compliance efforts, delineates the specific product-related responsibilities, and focuses on the platform’s readiness to adhere to GDPR principles.

Platform-Specific compliance:

  • The compliance and regulatory efforts are solely focused on the functionalities and data processing activities of the Registry Platform. Any compliance measures mentioned in this document refer exclusively to the platform’s data handling capabilities.

  • The platform’s compliance scope encompasses all data processing activities performed directly by the Registry Platform itself. It does not extend to any data processing activities conducted by third-party integrations or external services utilized by the platform and configured by developer of platform regulations.

  • The compliance efforts center on the protection of personal data collected, stored, processed, and transmitted within the Registry Platform. Other data processing activities within the organization (platform owner) fall outside the scope of this compliance documentation.

GDPR-readiness:

  • The Registry Platform is designed with a focus on Personal Data Protection Law thus transitively on GDPR-readiness, aiming to align with the key principles and requirements of data privacy regulations.

  • The platform is intended to support the rights of data subjects, including the right to access, rectify and erase on demand of their personal data.

  • The Registry Platform intends to maintain robust security measures, such as data encryption, access controls and audit to safeguard user data.

  • The platform’s compliance efforts also encompass ensuring data transparency and accountability in its data processing activities.

Exclusions:

  • This compliance document does not cover target organization’s (platform owner) general data protection practices or policies. It solely addresses the software part of platform’s compliance scope.

  • The Registry Platform may interact with other systems or services operated by the organization (platform owner). However, this compliance document does not extend to the compliance status of those external systems.

  • Third-party applications, services, or integrations utilized by the product are the responsibility of their respective owners and fall outside the scope of this compliance documentation

4. Data protection measures

The Data Protection Measures implemented in the Registry Platform are designed to ensure the security, confidentiality, and integrity of personal data processed by the software. Below are the key data protection measures implemented:

4.1. Encryption at rest and in transit

  • All data is stored on encrypted file systems. For more information, please visit Data encryption at rest

  • Data transmitted between the software and external systems, such as APIs or user devices, is encrypted using industry-standard cryptographic protocols (e.g., TLS/SSL). For more information, please visit Data encryption in transit

4.2. Access controls

Role-based access controls (RBAC) are implemented to restrict access to personal data based on the principle of least privilege. Access to personal data is limited to authorized personnel only, and authentication mechanisms are in place to verify users' identities.

For more information, please visit:

4.3. Data minimization and retention

The platform by itself follows the principle of data minimization. Hovewer forms and data modeling capabilities are fully owned by developers of registry regulations. Thus, developers should carefully select the type and amount of information requested and collected. By doing so, they aim to limit the data collection process to the bare essentials, thereby reducing the potential risks associated with excessive data exposure. This not only safeguards user privacy but also aligns with prevailing data protection regulations that emphasize the importance of minimizing personal data processing.

Personal data is retained only for as long as required to fulfill the intended purposes, since Registries Platform has been developed to meet a legal obligation under national legislation for government organizations, the prolonged storage of user data is utilized.

4.4. Pseudonymization

The Registry Platform doesn’t utilize pseudonymization techniques to replace identifiable information with reversible identifiers in order to reduce the risk of unauthorized access in favour of other more critical security controls.

4.5. Secure development practices

  • Secure coding guidelines are followed during the software development process to mitigate common vulnerabilities, (e.g., injection attacks, cross-site scripting).

  • Regular code reviews and static analysis tools are employed to identify and address security weaknesses.

For more information, please visit:

4.6. Data access logging and monitoring

  • The platform logs all data access and processing activities, including user actions and system events.

  • Centralized monitoring and log analysis tools are used to detect and respond to suspicious activities and potential security incidents.

  • The platform doesn’t log any confidential information.

For more information, please visit:

5. User data processing

5.1. Limit collection

The Registries Platform limits the collection of PII to the minimum that is relevant, proportional and necessary for the identified purposes. It means that platform limits the amount of PII that the organization (platform owner) collects indirectly (e.g. through web logs, system logs, etc.).

The organization (platform owner) should limit the collection of PII to what is adequate, relevant and necessary in relation to the identified purposes throught the registry regulations modeling. There is only one place where personal data leave the footprint beyond the business process scope is a historical data which is gathered as non-repudiation control.

5.2. Limit processing

The Registries Platform limits the processing of PII to that, which is adequate, relevant and necessary for the identified purposes. All the personal data collected through the modeled business processes handled to fulfill the objectives of user-initiated request only. Default settings prioritize data protection, minimizing the processing of personal data by disabling external system integrations. All the data related to business processes are transparently available for the data principal in user portal.

5.3. Accuracy and quality

The Registries Platform ensures that PII is as accurate and complete as is necessary for the purposes for which it is processed. In order to achieve its ambedded data validation control on business process modeling stage, digital documents validation and registry regulations' changes as well.

5.4. Temporary files

Temporary files and data which are produced as intermediaries of bussiness processes execution are automatically deleted once appropriate process is finished.

5.5. Disposal

The Registry Platform currently does not implement any specific data disposal approach.

5.6. PII transmission controls

Transmission of PII is controlled by ensuring that only authorized systems have access to transmission systems, and by following the appropriate processes to ensure that PII is transmitted without a compromise to the correct recipients.

The Registries Platform utilizes secure data exchange gateway. Its a modern organizational and technical solution that allows state bodies and local self-government bodies to use secure information interdepartmental interactions via the Internet by exchanging electronic messages between their information systems.

6. Data Subject Rights

6.1. Right to Access and Rectification

The Registry Platform is designed to satisfy almost all requirements of organization in terms of data processing due to extensive registry regulation development capabilities.

Registry regulation modeler can create a business processes which will let the data principal to access provided information in order to satisfy the right to access.

Another business process can be created and designed in a way to satisfy the right for rectification. It can utilize different approaches such as data re-upload for actualization or correction purposes.

6.2. Right to erasure (Right to be forgotten):

The Registry Platform has been developed to meet legal obligation under national legislation for government organizations, thus the prolonged storage of user data is utilized.

The platform is still subject to data protection laws and regulations, which may include provisions regarding the right to erasure. These laws outline the circumstances under which individuals can request the deletion of their personal data.

User is able to submit written erasure requests in order to trigger a data erasure process. Upon receiving a valid erasure request, the organization (platform owner) assesses whether the conditions for erasure are met based on legal requirements and the specific context of the data processing.

If the erasure request is approved, the platform administrator takes steps to delete the personal data in accordance with the applicable laws.

There is only one place where personal data leaves the footprint so far is a historical data which is gathered as non-repudiation control.

Certain exceptions may apply, such as legal obligations or public interest considerations that override the right to erasure. Organization (platform owner) must carefully balance individual rights with other legal obligations.

7. Security testing and validation

The security testing process is comprehensively described on Security testing page.

8. Training and awareness

Effective training and awareness programs play a crucial role in ensuring the responsible and secure use of the platform and the protection of personal data. It is important to emphasize that while the platform facilitates data processing and security measures, training is the responsibility of the organization (platform owner) and is not inherently built into the platform itself.

9. GDPR compliance at the registry level

9.1. Overview

The General Data Protection Regulation (GDPR) is a crucial legal framework dictating the principles and obligations for processing personal data in the European Union. Compliance with GDPR is imperative for any organization handling personal data, especially at the registry level. As a systematic data collection, a registry often contains sensitive personal information, necessitating strict adherence to GDPR guidelines.

9.2. Registry owner responsibilities

The primary responsibility for GDPR compliance at the registry level lies with the owner. This encompasses a range of duties outlined below.

  1. Data protection by design and default: The registry must be engineered with solid data protection mechanisms, including creating data structures that comply with GDPR norms. This involves implementing technical safeguards and privacy-friendly default settings to ensure data security and confidentiality.

  2. Lawful processing and consent management: The registry owner must ensure data is lawfully processed. This often involves obtaining explicit consent from individuals whose data is collected and processed, with clear information on the purpose and use of their data. Additionally, developing business processes that facilitate correct data management is crucial.

  3. Upholding data subject rights: It is critical to establish procedures to address the rights of individuals, such as the right to access their data, request corrections, or demand erasure of their data.

  4. Breach notification protocols: In the event of a data breach, the registry owner must have protocols in place for timely notification to the relevant supervisory authorities and, where applicable, to the individuals affected.

  5. Record-keeping and compliance documentation: Detailed records of data processing activities are essential. The registry owner must be able to demonstrate compliance with GDPR through these records.

9.3. Implementation guidelines

To align with GDPR, the registry owner should:

  • Conduct regular data protection impact assessments.

  • Ensure continuous training and awareness for staff handling personal data.

  • Establish clear policies and procedures for data processing and breach response.

  • Collaborate with data protection officers or external consultants for compliance verification.

9.4. Conclusion

Complying with GDPR at the registry level is a legal and ethical obligation for registry owners. It involves adhering to the regulation’s requirements and proactively developing data structures and business processes that ensure proper data management and privacy protection.