-
Notifications
You must be signed in to change notification settings - Fork 204
GDPRIsolation
Introduced in version 23.03. Note that turning on GDPR Country Isolation in the Configuration screen does not mean that openDCIM is "Certified GDPR Compliant," as that is an expansive list of rules/laws. openDCIM is in itself an Open Source Software project and is provided as-is under the GPL and makes NO CERTIFICATION to that compliance. However, the feature set added within this was commissioned by a benefactor company located within the EU that determined these features were necessary to work with their processes in order to match their interpretation of compliance. In other words, we are not lawyers, nor do we have the money to pay lawyers to determine if we meet the legal requirements for GDPR. Use at your own risk.
- PII Privacy - In this mode, a user in CountryA can still view assets in CountryB (assuming they are assigned to the Department that owns them, or if the user has ReadAccess) but the Audit Logs are scrubbed of all PII. Deleted users will show REDACTED for the UserID field, while privacy blocking will show a UserID of PIIProtected.
- Full Country Isolation - This completely isolates users to only interact with assets in their own country (see full description, below)
Full Country Isolation will take precedence over any other settings, so it is not necessary to set both Country Isolation and PII Privacy.
To utilize this effectively, you must set a countryCode for each user that is created in DCIM. Ideally you are utilizing Modern Authentication and have mapped an attribute to be passed that contains the 2-Letter ISO Country Code that the user is assigned to. You may also set within the Configuration screen the default country to assign users to in the event that you do not have the capability for automatic mapping.
Containers are the upstream units of Data Centers, so it is suggested that you create a container for each Country, especially if you have multiple data centers within that country. When a Data Center is created or moved within a Container, it will inherit the defined country for the Container. However, you may override the country by manually setting it for the Data Center. Country Codes are not assigned at any more granular level - in other words, you can't have a Data Center within openDCIM that contains Zones/Rows/Cabinets from multiple countries.
If and only if the GDPRCountryIsolation feature is enabled, those rules override any global ReadAccess, WriteAccess, and AdminOwnDevices rights that may have been assigned to the user. In other words, if you have user 'john' who is based in 'US' and is a member of Department 'Customer ABC' and 'Customer ABC' has assets in data centers based in 'US', 'CA', and 'FR', then 'john' will only be able to view and modify the devices within the 'US' data centers. Only a SiteAdmin has the ability to span all countries when the GDPRCountryIsolation feature is enabled. Based upon the interpretation of the GDPR Rules, if 'john' has a need to modify devices in both 'US' and 'FR' then he will need separate logins for those areas.
Reports will honor the ReadAccess right within the data centers that match the country of the User, unless they also have SiteAdmin.
We do not mark which countries are members of the EU. If you turn on the feature, it will isolate all countries from each other.