Add a new Policy
Policies allows user to govern the usage of personal data. You can review existing policies in
List of fields for the definition of policy:
It is unique identifier for the policy. It has the format: “Policy“ + “Allow” or “Deny” + “Processing“ or “Sharing“ + unique action.
It is description of the policy
There are two possible values. 1. “Deny”: It means that if the mentioned sources or data flows are detected for the repositories mentioned, it is a violation. The respective repositories are not supposed to process the data elements or have the data flows. 2. “Allow“: It means that if the mentioned sources or data flows are detected for the repositories other than mentioned, it is a violation. The mentioned data elements or data flows are only allowed for the repository mentioned.Developers use Slack for monitoring the applications. Logs, critical errors and events are sent. Often customer data is sent which results in an unauthorized access. You can have a policy to deny sharing any personal data on Slack. Policy: Restrict sharing of personal data on Slack
It is mandatory object. It has two keys - “sources” and “sinks”. If only “sources” are specified, it means the rule is to either allow or deny processing of data elements. If both “sources” and “sinks” are specified, it means the rule is to either allow or deny data flows.
It is mandatory key. It is array of regular expression for the data elements ids.
It is optional key. It is array of regular expression for the sink ids.
It is mandatory key. It specifies the repositories for which to evaluate the policy. Use
It’s an object of key-value pairs. This is useful to group and filter issues resulting from the policies. Example: you can tag applicable laws for the policies.
High level key is
policieswhich is an array of policy definitions. Once the policy object is defined, we can add it to the array of
You can either add policy definition to an existing a file or create a new yaml file. The policies are located at directory:
Once the new policy is added, Privado will evaluate the policy on the data elements and data flows after the code scan, and it will create the issues in case of policy violations.
Usage of Race, Ethnicity and Nationality in your Machine Learning and Artificial Intelligence model may make them bias towards certain individuals. You can have policy that prohibits the use of Race, Ethnicity and Nationality in Artificial Intelligence and Machine Learning models. Policy: Ethical AI usage policy
- id: Policy.Deny.Processing.EthicalUsageForAI
name : "Ethical AI Usage Policy"
description: "Don't use ethnicity, race and nationality for machine learning and AI"
fix: "Talk to the Privacy Engineering team: [email protected]"
laws: GDPR, CCPA2
Business intelligence dashboards are popular among business analysts to run queries and get insights to help customers and grow the business. Exposing personal data as part of these dashboards can lead to unauthorized access and breaches. You can have a policy to deny access of personal data such as name, email, mobile, address to your business dashboard applications. Policy: Restrict usage of personal data for Business Intelligence dashboards
- id: Policy.Deny.Processing.NoPersonalDataInBIReports
name : "Restrict usage of personal data in BI reports"
description: "Personal data in BI reports may expose it to unathorized access."
laws: GDPR, CCPA
This policy restricts Sensitive data (contact and PII phone number) of a customer whenever it is being shared to Slack. The detection is triggered whenever a dataflow between the marked sources and sinks is identified.
- id: Policy.Deny.Sharing.DontShareContactDataToSlack
name : "Restrict sharing customer contact data on Slack"
description: "Customer contact shared on Slack can lead to data breaches and unathorized access"
laws: GDPR, CCPA