Data protection
Why data projects in regulated industries fail at sign-off
In regulated organizations data projects rarely fail on technology. They fail because nobody can answer who saw what, and when.
A hospital, a state authority and a bank have little in common — except the structure of their problem. All three hold data whose analysis would obviously be useful, and in all three a sign-off sits between idea and implementation that technical arguments do not satisfy.
What auditors ask
From experience with such processes the list of questions is quite predictable. It is remarkably independent of the industry:
- Who accessed this dataset, over what period, under what authorization?
- How was this figure produced — from which sources, through which steps?
- What happens when an employee changes department? When do they lose access?
- Can you reproduce the state as of the reporting date, or only today's?
- Who at the vendor can access this data, and how would you know?
None of these questions is about speed, functionality or cost. All five are about traceability. And all five are laborious to answer with a standard installation.
An auditor does not ask for security. They ask for evidence. That difference shapes architectures.
Question five is the one that tips projects over
The first four questions can be answered with careful configuration. The fifth cannot, if the service runs at a provider. By construction there is then an administrative path the provider needs in order to operate the service.
Providers address this with customer-managed keys, sealed environments and access logs. Those are serious measures. But they shift the question from “can anyone access this” to “would we find out” — and for a sign-off that is a weaker answer.
What gets easier on your own infrastructure
| Requirement | At a provider | On your own infrastructure |
|---|---|---|
| Access evidence across all users | the provider's logs | your own audit log and retention |
| Rule out vendor access | contractual and organizational | technical, no path exists |
| Operation without internet access | usually not possible | possible, offline updates |
| Reproduce a reporting date | depends on the product | time travel in the table format |
| Keys in your own HSM | sometimes possible | standard |
The third row is underestimated. Operating without an internet connection — air-gapped — is in some environments not a precaution but a requirement. If a platform needs outbound telemetry or licence checks, it cannot be used there, regardless of everything else.
Frameworks you can lean on
Rather than asserting security in general, it helps to attach to established frameworks. In Germany those are primarily the BSI's IT-Grundschutz and ISO/IEC 27001. Both describe measures an auditor recognizes and can tick off — and both are useful even without pursuing certification, because they prescribe the structure of the evidence.
For personal data the requirements of Article 32 GDPR come on top: encryption, pseudonymization, availability, resilience and the ability to verify the effectiveness of the measures. That last point points back to the audit log.
What I advise project owners
Do not seek sign-off at the end but at the beginning. Concretely: ask the five questions above before selecting a product and require the answers in writing. A vendor who evades question five will not become clearer later — except that by then you have already migrated.
And internally, bring the data protection officer or the information security officer into the selection, not into acceptance testing. Their requirements are rarely surprising, but they are rarely retrofittable.
Sources
Every figure in this article is sourced. Where no defensible source exists, no figure is given.