Cloud & IT Cert Prep · Lesson

GDPR on Azure

Implement the technical measures required by GDPR on Azure — data residency, encryption at rest and in transit, right to erasure, and breach notification.

GDPR on Azure is a free Cloud & IT Cert Prep lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cloud & IT Cert Prep learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is GDPR?

The General Data Protection Regulation (GDPR) is a European Union regulation that governs how personal data of EU residents must be collected, stored, processed, and protected. It applies to any organisation worldwide that processes the personal data of people in the EU — not just companies based in Europe. GDPR violations can result in fines of up to €20 million or 4% of global annual revenue, whichever is higher.

Key GDPR Principles

GDPR is built on six data protection principles that must be applied to all personal data processing:

Lawfulness, fairness, and transparency — have a legal basis for processing
Purpose limitation — collect data only for specified purposes
Data minimisation — collect only what is necessary
Accuracy — keep data up to date
Storage limitation — delete data when no longer needed
Integrity and confidentiality — secure data against unauthorised access

Data Residency on Azure for GDPR

GDPR requires that personal data of EU residents must not be transferred to countries outside the EU/EEA unless adequate protection is in place. On Azure, ensure that resources processing EU personal data are deployed in European regions (e.g., West Europe, North Europe, Germany West Central). Azure's region pairing ensures that data stays within the same geographic area. Additionally, disable geo-replication to non-EU regions unless transfer safeguards (Standard Contractual Clauses) are in place.

# Deploy resources in EU regions to ensure data residency:
az group create \
  --name myEURG \
  --location westeurope

# For Azure SQL, confirm geo-replication secondary is also in EU:
az sql db replica create \
  --server mySqlServer \
  --name myDB \
  --partner-server myEUSecondaryServer \
  --partner-resource-group secondaryEURG

Encryption for GDPR Compliance

GDPR's integrity and confidentiality principle requires appropriate technical measures, which includes encryption. On Azure:

Encryption at rest — all Azure storage (Blob, SQL, Cosmos DB) encrypts data at rest by default using AES-256
Encryption in transit — enforce HTTPS/TLS for all communications; disable HTTP endpoints
Customer-managed keys — for higher control, use Azure Key Vault to manage your own encryption keys rather than relying on Microsoft-managed keys

# Enforce HTTPS only on a web app:
az webapp update \
  --resource-group myRG \
  --name myWebApp \
  --https-only true

# Create a storage account with customer-managed key encryption:
az storage account create \
  --resource-group myRG \
  --name mystorageaccount \
  --encryption-key-source Microsoft.Keyvault \
  --encryption-key-vault https://myKeyVault.vault.azure.net/

Right to Erasure (Right to Be Forgotten)

Under GDPR Article 17, individuals have the right to erasure (also called 'right to be forgotten') — the right to request that their personal data be deleted. Your application must support this by locating all personal data for a user across all Azure services (SQL Database, Blob Storage, Cosmos DB, Log Analytics, etc.) and deleting it on request. Microsoft Purview data maps can help identify where personal data is stored.

# Example: delete a user's data from Azure SQL Database
# Application handles this via a stored procedure or API endpoint
# DELETE FROM users WHERE user_id = 'data-subject-id';
# DELETE FROM orders WHERE customer_id = 'data-subject-id';
# DELETE FROM audit_log WHERE user_id = 'data-subject-id';
# Also purge from Log Analytics: use Azure Monitor data export + purge API

Right to Data Portability

GDPR Article 20 gives individuals the right to data portability — the right to receive their personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) and to transfer it to another controller. Your application must be able to export all personal data associated with a user on request. Azure services like Azure Data Factory can automate the extraction and packaging of personal data for portability requests.

Breach Notification Requirements

GDPR Article 33 requires that data breaches involving personal data must be reported to the relevant supervisory authority (DPA) within 72 hours of becoming aware of the breach. Article 34 requires notifying affected individuals if the breach poses a high risk to their rights. On Azure, Microsoft Defender for Cloud and Microsoft Sentinel help detect breaches quickly, while documented incident response procedures ensure the 72-hour notification window is met.

Microsoft Data Protection Addendum

When using Azure to process EU personal data, Microsoft acts as a data processor and your organisation is the data controller. Microsoft's Data Protection Addendum (DPA) is the contractual agreement governing how Microsoft processes personal data on your behalf. The DPA is incorporated by reference into the Microsoft Customer Agreement and satisfies the GDPR requirement for a written agreement between controller and processor.

Access Controls and Least Privilege

GDPR's access controls requirement means only authorised personnel should access personal data. Implement Azure RBAC with the principle of least privilege — grant users only the specific permissions they need to do their job, not broad admin access. Use Privileged Identity Management (PIM) for just-in-time access to databases containing personal data, and log all access to sensitive data in Azure Monitor for audit purposes.

Data Retention and Automated Deletion

GDPR's storage limitation principle requires that personal data is not kept longer than necessary. Implement Azure Blob Storage lifecycle management policies to automatically move or delete data after a specified retention period. For databases, schedule automated stored procedures to purge records older than the retention policy. Document your retention schedules in a Records Retention Policy and use Azure Policy to enforce it.

# Blob Storage lifecycle policy to delete after 365 days:
az storage account management-policy create \
  --account-name mystorageaccount \
  --resource-group myRG \
  --policy '{
    "rules": [{
      "name": "deleteAfterYear",
      "type": "Lifecycle",
      "definition": {
        "actions": {"baseBlob": {"delete": {"daysAfterModificationGreaterThan": 365}}},
        "filters": {"blobTypes": ["blockBlob"]}
      }
    }]
  }'

DPIA: Data Protection Impact Assessment

For high-risk personal data processing activities, GDPR Article 35 requires a Data Protection Impact Assessment (DPIA) before starting the processing. A DPIA systematically analyses the processing activity, identifies risks to individuals' rights, and documents the mitigation measures in place. Azure's threat modelling tools and Purview's data classification results can provide valuable inputs to a DPIA.

Quick Check

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

Lesson Recap

In this lesson you learned: GDPR applies to all organisations processing EU residents' personal data and requires lawful processing, security controls, and breach notification; key technical measures include data residency in EU regions, encryption at rest and in transit, and automated retention policies; and Microsoft's Data Protection Addendum governs how Azure processes your personal data as a processor. Next up we explore the Cloud Adoption Framework for enterprise migrations.

Frequently asked questions

Is the “GDPR on Azure” lesson free?

Yes — the full text of “GDPR on Azure” is free to read here on the web, and the Cloud & IT Cert Prep course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cloud & IT Cert Prep course, upgrade to CoddyKit PRO.

What will I learn in “GDPR on Azure”?

Implement the technical measures required by GDPR on Azure — data residency, encryption at rest and in transit, right to erasure, and breach notification. You practise Cloud & IT Cert Prep with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cloud & IT Cert Prep?

No prior experience is required. Cloud & IT Cert Prep on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “GDPR on Azure” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cloud & IT Cert Prep lesson?

Yes. Every Cloud & IT Cert Prep lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cloud & IT Cert Prep