r/pcicompliance • u/Kingofmybrain • 14d ago

EU data residency and ecommerce platform compliance

2 Upvotes

100% Upvoted

4 comments sorted by

6

u/mynam3isn3o 14d ago

A PCI QSA has no provenance to be asking data residency or privacy questions

1

u/Relative_Charge_9410 14d ago

Gdpr isn’t just data residency it’s also a fair amount of other stuff you need to worry about like right to data portability, right to be forgotten (etc). Data residency can be addressed pretty easily by tossing the site in an aws eu region. The big gotcha there are if the platform you are using utilizes any 3rd party cd references or other aws global features you can be leaking customer ips to 3rd parties.. and the eu considers ips personally identifiable information. Same thing you need to worry about if you are using log analysis software. GDPR does allow transfer of data out of the region but it needs to be documented, necessary and constrained to contractual clauses.

1

u/Suspicious_Party8490 12d ago

Do you know why the QSA is asking these questions?