Customer data protection
The goal of this article is to provide insight on how to deal with a customer’s information without risk of sensitive data disclosure to third parties not involved in the project.
Risk definition
WorkFusion customer organizations hold terabytes of datasets about their customers or their activities. Those organizations have to release data files containing private information to WorkFusion for data analysis, model training or support.
The challenge of data privacy is to utilize data while protecting individual privacy preferences and personally identifiable information. Information Privacy Law prohibits the disclosure or misuse of information about private individuals.
Information privacy rules must be strictly followed by Data Analysts, as ignorance can easily lead to customer and WorkFusion contract termination, make both parties liable as violations of law, and even lead to companies being shut down.
There are two possible scenarios of working on a project, and consequently two ways of accessing data.
| Scenario | Security level |
|---|---|
| On-site | High |
| Remote via VDI* | Medium |
* VDI: Virtual desktop infrastructure is virtualization technology that hosts a desktop operating system on a centralized server in a data center.
Let’s review each scenario in detail.
Information privacy rules
Work at customer site
When working directly from the client’s office, as usual, you are provided by the company’s laptop that will have all the necessary programs already pre-installed.
You should prepare a list of software you may need on the project for approval before the start of the project. All additional tools or programs you may need in the course of work MUST be agreed upon with the customer.
Don'ts:
- Use any memory sticks, discs or any other devices to copy information to and from the customer’s computer.
- Send any piece of a customer’s information (even if it doesn’t contain any sensitive data) outside, where it can be accessed by non-engaged parties (even to yourself—to your WorkFusion email, your private email, your colleague or DM) without mentioning it to somebody from the customer’s side.
- Take any photos of customer’s laptop screen.
- Bring customer’s computer out of the customer's premises without explicit approval by customer.
Work remote via VDI
Just as when working on-site it’s not permissible to install any software on a customer's VDI without approval.
Don'ts:
- Share your credentials. When first installing VDI, you’re provided with different logins, security keys, passwords that shouldn't be shared with anybody.
- Send and receive any attachments with a customer's information from and to your WorkFusion account. To share information with the team engaged in the project, create a mailbox on VDI or a ShareFolder where all the necessary information will be stored. In the very beginning you should notify a customer that no sensitive data should be sent to your WorkFusion email. Everything related to the project can be provided ONLY by sending to the email on VDI or by putting to the ShareFolder.
- Copy any piece of a customer's information (including screenshots of VDI) on your local machine.