-
Overview
At AWS, customer trust is our top priority. We deliver services to millions of active customers, including enterprises, educational institutions, and government agencies in over 190 countries. Our customers include financial services providers, healthcare providers, and governmental agencies, who trust us with some of their most sensitive information.
We know customers care deeply about privacy and data security. That’s why AWS gives them ownership and control over their content, by design, through simple, but powerful tools that allow customers to determine where their content will be stored, to secure their content in transit or at rest, and to manage access to AWS services and resources for their users. We also implement responsible and sophisticated technical and physical controls designed to prevent unauthorized access to or disclosure of customer content.
Maintaining customer trust is an ongoing commitment, we strive to inform customers of the privacy and data security policies, practices and technologies we’ve put in place. These commitments include:
- Access: Customers manage access to their customer content and AWS services and resources. We provide an advanced set of access, encryption, and logging features to help you do this effectively (such as AWS CloudTrail). We do not access or use customer content for any purpose other than as legally required and for maintaining the AWS services and providing them to our customers and their end users.
- Storage: Customers choose the region(s) in which their customer content will be stored. We will not move or replicate customer content outside of the customer’s chosen region(s), except as legally required and as necessary to maintain the AWS services and provide them to our customers and their end users.
- Security: Customers choose how their customer content is secured. We offer our customers strong encryption for customer content in transit or at rest, and we provide customers with the option to manage their own encryption keys.
- Disclosure of customer content: We do not disclose customer content unless we’re required to do so to comply with the law or a valid and binding order of a governmental or regulatory body. Unless prohibited from doing so or there is clear indication of illegal conduct in connection with the use of Amazon products or services, Amazon notifies customers before disclosing customer content so they can seek protection from disclosure.
- Security Assurance: We have developed a security assurance program using global privacy and data protection best practices in order to helping customers establish, operate and leverage our security control environment. These security protections and control processes are independently validated by multiple third-party independent assessments.
AWS classifies customer data into two categories: customer content and account information.
We define customer content as software (including machine images), data, text, audio, video or images that a customer or any end user transfers to us for processing, storage or hosting by AWS services in connection with that customer's account and any computational results that a customer or any end user derives from the foregoing through their use of AWS services. For example, customer content includes content that a customer or any end user stores in Amazon Simple Storage Service. Customer Content does not include account information, which we describe below. The terms of the AWS Customer Agreement or other agreement with us governing the use of AWS services apply to your customer content.
We define account information as information about a customer that a customer provides to us in connection with the creation or administration of a customer account. For example, account information includes names, usernames, phone numbers, email addresses and billing information associated with a customer account. The information practices described in the AWS Privacy Notice apply to account information.
Customers maintain ownership of their customer content and select which AWS services process, store and host their customer content. We do not access or use customer content for any purpose other than as legally required and for maintaining the AWS services and providing them to our customers and their end users. We never use customer content or derive information from it for marketing or advertising.
Customers control their customer content. With AWS, customers:
• Determine where their customer content will be stored, including the type of storage and geographic region of that storage.
• Choose the secured state of their customer content. We offer customers strong encryption for customer content in transit or at rest, and we provide customers with the option to manage their own encryption keys.
• Manage access to their customer content and AWS services and resources through users, groups, permissions and credentials that customers control.
We know that customers care how account information is used, and we appreciate customers' trust that we will do so carefully and sensibly. The AWS Privacy Notice describes how we collect and use account information.
We are vigilant about our customers' privacy. We do not disclose customer content unless we're required to do so to comply with the law or a valid and binding order of a governmental or regulatory body. Governmental and regulatory bodies need to follow the applicable legal process to obtain valid and binding orders, and we review all orders and object to overbroad or otherwise inappropriate ones. Unless prohibited from doing so or there is clear indication of illegal conduct in connection with the use of Amazon products or services, Amazon notifies customers before disclosing customer content so they can seek protection from disclosure. It's also important to point out that our customers can encrypt their customer content, and we provide customers with the option to manage their own encryption keys.
We know transparency matters to our customers, so we regularly publish a report about the types and volume of information requests we receive here.
Customers choose the region(s) in which their customer content will be stored, allowing them to deploy AWS services in the location(s) of their choice, in accordance with their specific geographic requirements. AWS datacenters are built in clusters in various regions around the globe.
For example, an AWS customer in the UK can choose to deploy its AWS services exclusively in the Europe (London) region and store their content onshore in the UK. If the customer make this choice, their customer content will be located in the UK. Customers can replicate and back up their customer content in more than one region, and we will not move or replicate customer content outside of the customer's chosen region(s), except as legally required and as necessary to maintain the AWS services and provide them to our customers and their end users.
*All AWS services may not be available in all regions.
When evaluating the security of a cloud solution, it is important for customers to understand and distinguish between:
• Security measures that AWS implements and operates - "security of the cloud"
and
• Security measures that customers implement and operate, related to the security of their customer content and applications that make use of AWS services - "security in the cloud"
For a complete list of all the security measures built into our core AWS cloud infrastructure, platforms and services, please read our Overview of Security Processes Whitepaper.
We have developed a security assurance program using additional global privacy and data protection best practices in order to help customers establish, operate and leverage our security control environment. These security protections and control processes are independently validated by multiple third-party independent assessments.
AWS’s alignment with ISO 27018 has been validated by an independent third party assessor. ISO 27018 is the first International code of practice that focuses on protection of personal data in the cloud. It is based on ISO information security standard 27002 and provides implementation guidance on ISO 27002 controls applicable to Personally Identifiable Information (PII) processed by public cloud service providers. This demonstrates to customers that AWS has a system of controls in place that specifically address the privacy protection of their content. For more information, please visit the AWS ISO 27018 FAQ.
AWS data centres are built in clusters in various countries around the world. We refer to each of our data center clusters in a given country as a "Region." Customers have access to sixteen AWS Regions around the globe, including three Regions in the EU – Ireland (Dublin), the UK (London) and Germany (Frankfurt). Customers can choose to use one Region, all Regions or any combination of Regions.
AWS customers choose the AWS Region(s) where their content will be stored. This allows customers with specific geographic requirements to establish environments in a location(s) of their choice. For example, AWS customers in Europe can choose to deploy their AWS services exclusively in one of the Regions in the EU (Germany, the UK, or Ireland). If the customer elects to do so, their content will be stored in Germany, the UK or Ireland, as they choose, unless the customer explicitly selects to move or replicate their content in a different AWS Region.
Customers can replicate and back up content in more than one Region, but AWS does not move customer content outside of the customer’s chosen Region(s), except to provide services as requested by customers or comply with applicable law.
AWS maintains certification with robust security standards, such as ISO 27001, SOC 1/2/3 and PCI DSS Level 1. We operate a shared responsibility model in the Cloud, under which AWS is responsible for the security of the underlying Cloud infrastructure (Security of the Cloud) and customers are responsible for the security of their data and applications (Security in the Cloud). AWS has teams of Solutions Architects, Account Managers, Consultants, Trainers and other staff in the EU expertly trained on cloud security and compliance to assist AWS customers in achieving high levels of security and compliance in the Cloud, following Cloud Security Best Practices. AWS also helps customers meet local security standards. For example, AWS alongside auditor TÜV TRUST IT, has published a Customer Certification Workbook that provides guidance on achieving German BSI IT Grundschutz compliance in the Cloud.
-
EU Directive
The EU Data Protection Directive (also known as Directive 95/46/EC) is a regulation that covers the processing of personal data and on the free movement of such data. Broadly, this Directive sets out a number of data protection requirements which apply when personal data is being processed.
-
GDPR
In 2016, the European Commission approved and adopted the new General Data Protection Regulation (GDPR). The GDPR is the biggest change in data protection laws in Europe since the introduction of the EU Data Protection Directive, also known as Directive 95/46/EC, in 1995. The GDPR aims to strengthen the security and protection of personal data in the EU and harmonize EU data protection law. The GDPR will replace the EU Data Protection Directive, as well as all local laws relating to it.
AWS welcomes the GDPR. It protects European citizens’ fundamental right to privacy and the protection of personal data. It introduces robust requirements that will raise the bar for data protection, security, and compliance and will push the industry to implement stringent controls. We can confirm that all AWS services will comply with the GDPR when it becomes enforceable on May 25, 2018.
In addition to our own compliance, AWS is committed to offering services and resources to our customers to help them comply with GDPR requirements that may apply to their operations.
