Compliance in regulated industries is often difficult to understand, so we are taking a closer look at Office 365 and how Microsoft addresses key regulatory requirements.
Firms working within regulated industries, such as solicitor practices and financial services, are subject to strict regulatory standards. These standards extend across all aspects of business, including technology. Regulatory bodies, such as the Solicitors Regulation Authority and the Financial Conduct Authority, impose strict requirements around the management, processing and security of client data. Despite common misconceptions, these requirements do not preclude the use of cloud technologies and the benefits of Cloud computing are still available to be reaped.
Data Residency and Data Protection
The EU data protection regulation stipulates that data should not be transferred outside the EU, unless to a country with similarly high data protection standards. Office 365 complies with this legislation by adopting a regionalised data centre strategy, storing European customer data in either its Dublin or Amsterdam data centres.
In April 2014, Microsoft became the first (and to date, only) cloud provider to receive approval from the Article 29 Working Party, an independent advisory body established by the European Parliament to focus on data protection. The ruling confirmed that Microsoft meets the high standards of EU data protection legislation so regardless of where data is stored, it is protected to a standard approved by EU authorities.
Microsoft is also certified under the Safe Harbor Framework, recognising companies aligned with EU data privacy rules. Businesses that wish to legally transfer data from the EU to the U.S. must comply with the Safe Harbour principles.
Client Confidentiality
Client confidentiality is a key concern for businesses working within regulated industries. Microsoft provides contractual security commitments that protect your data at all times. Confidential information will not be disclosed to third parties, nor used for any purpose other than that agreed. If a government request is received to access your data, Microsoft commit to notifying you, unless they are legally prohibited from doing so.
Security
Regulatory bodies often request security compliance with ISO 27001 2005 as minimum. Office 365 and the infrastructure layer on which it relies are ISO 27001 certified, delivering:
- 24-hour monitoring and restricted access to data centres
- Encryption of data at rest and during transmission
- Data loss prevention to avoid sensitive data from leaking either inside or outside the organisation
- Enforcement of “hard” passwords and multi-factor authentication
Data Ownership and Regulatory Access
Regulated firms must have adequate agreements with their providers to allow regulatory bodies to access and inspect their data. With Office 365, you own your data, retain all rights to it and can download a copy of it at any time. This can be done without Microsoft assistance and subsequently issued to your regulatory body.
Data Recovery
The data backup and continuity arrangements of your cloud provider are important. Office 365 backs up your data at least once a week and maintains multiple copies across its data centres. It also commits to delivering at least 99.9% up-time with a financially-backed guarantee.
USA Patriot Act
The USA Patriot Act applies to companies based anywhere in the world with a US parent company. It obliges them to disclose information on their customers to US Government agencies without their knowledge or consent, potentially conflicting with EU data protection laws. Despite its severe reputation, the Patriot Act is no more intrusive than similar interception regimes across EU member states, such as the UK Regulation of Investigative Powers Act 2000. The Patriot Act is also limited in scope and does not apply to the majority of cloud customers. Where it does apply, Microsoft’s certification with the Safe Harbour Agreement ensures compliance with the EU Data Protection Directive.
Microsoft is at the forefront of security and management of cloud services. As highlighted above, Office 365 provides a good fit for companies working within heavily regulated industries.
In addition to Microsoft’s commitments, undertaking your own due diligence, establishing policies, training and security measures means you can ensure continued regulatory compliance.
The benefits of Office 365 are available for reaping by regulated industries and as a topic of #CloudEducation, we have started the research for you.
Founder and Managing Director - Foration
Paul Weeden is the Founder and Managing Director of Foration, an IT services company helping businesses grow through technology. Starting his career at IBM in 2000, Paul quickly found a passion for IT and challenging what it can do for business. He successfully runs an apprenticeship scheme at Foration and acts as a mentor for entrepreneurs at the Founder Institute.