Enabling SQL Audit on Azure SQL Database for GDPR compliance

Question

Hello,

We're looking to configure a new Azure SQL Server/Database so that it is GDPR compliant. I would like to enable SQL Audit on the server and database, but I know that some of the data captured would include customer PII. In the event we have a request to delete customer data do we need to also delete the PII data captured by SQL Audit? My understanding is this can be considered an 'exception to the rule' provided we delete their data from the database.

I'm having trouble finding any documentation that explicitly answers this question, so any help will be much appreciated! Thanks.

Answer 1

My understanding is that before you enable auditing you should classify your data and use column encryption, always encrypted and other methods to protect PII data.

Initially to analyze the risks on the organization and perform Data Protection Impact Assessment explained on GDPR Article 35, you can use Azure SQL Auditing as a tool to determine those risks.

GDPR Article 33 "Notification of a personal data breach to the supervisory authority" express that audit records should exist of all the processes related to personal data. Those are mechanisms you should create using tables with encrypted columns that you can show how data has been changing over time in case of regular GDPR audit processes and where Azure SQL Auditing should not be used to my knowledge. For meet the requirements of Article 33 you can use Advanced Threat Protection on Azure SQL and configure the "send email notifications" option that it offers.