Category Archives: privacy

Auto Added by WPeMatico

Windows resources to help support your GDPR compliance

With exactly eight months to go until the deadline, any organization that wants to do business with European Union (EU) residents will need to ensure compliance with the General Data Protection Regulation (GDPR). According to a recent report by Spiceworks, only 25 percent of organizations are prepared for this landmark regulatory requirement. At Microsoft, we are actively helping accelerate our customers’ compliance journey. Earlier this year, Brendon Lynch, our Chief Privacy Officer, announced our commitment to the principles behind GDPR and to helping organizations successfully comply with this new regulation.
Today, we are sharing two new Windows resources, Accelerate GDPR compliance with Windows 10 and Accelerate GDPR compliance with Windows Server 2016 white papers, that will help you plan and prepare for the GDPR deadline.
These important resources detail the security features and capabilities built into Windows that can help you comply with GDPR and implement the technical and organizational security measures to help protect personal data. For Windows 10 these compliance capabilities include:
Threat Protection: Pre-breach Threat Resistance
Threat Protection: Post-breach Detection and Response
Identity Protection
Information Protection
Additional capabilities for Windows Server include:
Credential and administrator privilege protections
Secure the operating system to run your apps and infrastructure
Secure virtualization
Implementing the appropriate technical and organizational security measures to protect personal data will take time, changes in process, expertise and training for your organization to comply with GPDR. For those just getting started, we recommended you begin your journey to GDPR compliance by focusing on four key steps:

While these requirements may seem daunting, Windows can help you effectively and efficiently address many of the GDPR requirements.
Threat, identity & information protection
As Brad Smith noted this summer, there is no privacy without security. That’s why we’ve always focused on security technologies and privacy features in our Windows operating system (OS) to help safeguard your information.
With Windows 10, your ability to protect, detect and defend against the types of attacks that can lead to data breaches is greatly improved. Given the stringent requirements around breach notification within the GDPR, ensuring that your desktop and laptop systems are well defended will lower the risks you face that could result in costly breach analysis and notification.
A key provision within the GDPR is data protection by design and by default. Helping with your ability to meet this provision are features within Windows 10 such as BitLocker Device Encryption.  BitLocker uses the Trusted Platform Module (TPM) technology, which provides hardware-based, security-related functions.  This crypto-processor chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM.
We encourage you to learn more about security technologies in the Accelerate GDPR compliance with Windows 10 white paper.
Identity protection, credential management & infrastructure security
Security breaches can have profound consequences for your organization. Windows Server 2016 has built-in risk mitigation capabilities to help implement technical and organizational security measures to protect personal data. These include a secure operating system to run your apps and infrastructure, anti-malware technologies that protect your environment from threats and exploits, and identity protection and credential management solutions that enable you to move from passwords to more secure forms of authentication. These are important elements of our defense-in-depth strategy that, combined with a layer of information protection, is built into hardware and virtual systems.
The GDPR requires you to implement appropriate technical and organizational security measures to protect personal data and processing systems. In the context of the GDPR, your physical and virtual server environments are potentially processing personal and sensitive data. Processing can mean any operation or set of operations, such as data collection, storage, and retrieval.
The ability to protect personal and sensitive data, that may be stored or accessed through desktops or laptops, will be further enhanced by adopting advanced authentication capabilities and access management.
As you work to comply with the GDPR, understanding the role of your physical and virtual servers in creating, accessing, processing, storing and managing data that may qualify as personal and potentially sensitive data under the GDPR is important. Windows Server provides capabilities that will help you comply with the GDPR requirements to implement appropriate technical and organizational security measures to protect personal data.
Additional details can be found in the Accelerate GDPR compliance with Windows Server 2016 white paper.
Get started today
Together with Microsoft’s comprehensive Cloud portfolio and the Microsoft 365 solutions announced today, these new Windows resources can help you make meaningful progress in preparation for these regulations. I encourage you to check them out to see how Windows can help simplify your GDPR journey.
In the coming months, we will continue to share how Windows is getting ready for GDPR and how using Windows can help you with your compliance journey. We also want to hear from you, so please also continue sharing your feedback and privacy questions.
– Marisa

Privacy enhancements coming to the Windows 10 Fall Creators Update

In April, we outlined significant enhancements made to the Windows 10 Creators Update that gives you more control to make informed decisions about your privacy. Those enhancements included improving in-product information about your privacy, updates to the Microsoft privacy statement, and improving transparency by publishing more information about the diagnostic data we collect.
Continuing with our commitment to privacy and data control, today we’re announcing privacy enhancements coming to the Windows 10 Fall Creators Update for consumers and commercial customers that further increase your access to information and provides you more control over what information is collected.
For consumers, some of the new experiences you will see include:
Easier access to privacy information during setup
To simplify your access to information about the features we offer, and the data collection and use around those features, we have made two privacy changes to the setup process.
First, we are giving users direct access to the Privacy Statement within the setup process. Second, as you set up a new device, the Learn More page on the privacy settings screen enables you to jump to specific settings for location, speech recognition, diagnostics, tailored experiences, and ads while you choose your privacy settings. You no longer need to sift through the privacy statement if you only want to read about a specific feature, simply click the Learn More button for easy access.
We want you to have all the information about your privacy setting options readily available so that you can make an informed decision about your privacy and how your data is used.

Ability to set application controls beyond location
Likewise, it’s important to us that you have transparency and control over which applications can access your information. Most users are accustomed to being prompted for permission to use location data when using a map or other location-aware application. Starting with the Fall Creators Update, we’re extending this experience to other device capabilities for apps you install through the Microsoft Store. You will be prompted to provide permission before an app can access key device capabilities or information such as your camera, microphone, contacts, and calendar, among others. This way you can choose which apps can access information from specific features on your device. (You can learn more about Windows app permissions here.)

App permission prompts will only apply to apps installed after the Fall Creators Update. To review and manage your existing app permissions go to Start, select Settings, then select Privacy.
Windows Analytics setting
Likewise, our Enterprise customers asked us to provide them with greater control over which data is shared with us to enable new services. In addition to the above enhancements, we’re also providing a new setting that limits diagnostic data to the minimum required for Windows Analytics. Windows Analytics allows Enterprise administrators to decrease IT costs by gaining insights, using Windows Diagnostics, into the computers running Windows 10 in their organizations. It is a fast-growing Microsoft service – providing data-driven insights that reduce the cost of deploying, servicing, and supporting Windows 10. To learn more about Windows Analytics and how your company can benefit from Windows diagnostics data, visit the Windows Analytics website.
As part of our ongoing dialogue and transparency with you, our customers, I am excited to announce these privacy changes coming next month in the Fall Creators Update. Windows Insiders will get an early look of some of these changes in the coming weeks. I look forward to continued dialogue and hearing your feedback here.
-Marisa