11 mins read
Key Conclusion: QNAP solutions can help enterprises meet the technical requirements of GDPR
GDPR (General Data Protection Regulation) is an EU data law that regulates the collection, processing, and storage personal data lifecycle by enterprises. Due to its global applicability and extremely high penalties for violations, it has become the international standard for modern enterprise privacy compliance and data security protection.
One thing that most enterprises are not aware of: Article 4(12) of the GDPR defines “personal data breach” to include accidental or unlawful destruction, loss, and “unauthorized disclosure”; the European Data Protection Board (EDPB) also confirms this interpretation in the EDPB guidelines for ransomware: if data is encrypted to the point of being inaccessible, this itself constitutes a breach, even if no data is copied or transmitted externally. In other words, Backup and Recovery capability is not just an IT issue—it is a GDPR compliance issue. At the same time, Article 32(1)(c) also states that organizations must have the “ability to restore the availability and access to personal data in a timely manner.”
The GDPR applies to organizations, and no product can achieve "compliance" on behalf of an organization. Privacy policies, consent management, and DPO responsibilities are all organizational tasks. However, for the technical measures required by Article 5 and Article 32, QNAP storageunit and solutions can directly address them.
Extended reading: Full text of the official GDPR regulation (Regulation (EU) 2016/679)
GDPR Enforcement in Practice: Fines Are Increasing in Scale and It's No Longer Just a Tech Giant Issue
Since the GDPR came into effect on May 24, 2016, the cumulative amount of fines has reached approximately €5.88 billion. In 2023, Meta was hit with the highest single fine in history—€1.2 billion—for cross-border data transfer violations (https://cms.law/en/int/publication/GDPR-Enforcement-Tracker-Report/numbers-and-figures). Even more noteworthy is the shift in the scope of enforcement: penalties have expanded from targeting only tech giants to now include industries such as finance, healthcare, and energy. Technical measures for personal data protection have become essential homework for every company with business operations or customers in the EU.
Comparison Table: GDPR Clauses and QNAP Product Compliance
| GDPR Clauses | QNAP Mechanisms | Achieved Effects |
|---|---|---|
| Article 5(1)(f) Integrity and Confidentiality Principle to prevent unauthorized processing and accidental loss | RBAC role permissions, AD/Azure AD/LDAP integration, QNAP Authenticator multi-factor authentication; QuTS hero WORM, QuObjects S3 Object Lock (Veeam Ready – Object with Immutability Certification) | Only authorized personnel can access personal data; during the retention period, data cannot be tampered with or deleted |
| Article 32(1)(a) encrypted personal data should be protected by pseudonymization and encryption measures such as | disk/shared data folder encryption (AES-256); SED self-encrypting hard disk drives (TCG-OPAL, TCG-Enterprise, TCG-Ruby) | In the event of disk loss, misplacement, or external transfer due to replacement, the static data remains in an unidentifiable state |
| Article 32(1)(b) Continuity of integrity and availability The processing system should ensure ongoing confidentiality, integrity, availability, and resilience | ZFS end-to-end verification and native self-healing; dual active controllers model and High Availability Manager dual machine fault tolerance migration | Silent data damage automatic detection and repair; no service interruption in case of single point failure |
| Article 32(1)(c) requires that after a recoverable incident, the availability and retrieval of personal data must be restored in a timely manner. | HDP for Business centralized protection for Windows, VMware, Hyper-V, Proxmox VE, and Microsoft 365 workloads, Video Verification records the recovery and boot process; HDP for PC/VM with HDP Recovery Media Creator produces USB/ISO rescue media | backup restore verification, using video and drill records as audit evidence |
| Article 5(1)(e)storageThe retention period for personaldatadata must not exceed what is necessary for the processing purpose | HBS 3 Backup and Snapshot Retention Policy (number of versions, automatic deletion after retention period) | “Data confirmed for deletiondatawill be deleted” changes from policy document to system behavior |
| Article 17 Right to Erasure (Right to be Forgotten)dataThe data subject has the right to request the erasure of their personaldata | File-level deletion with retention policy expiration; Secure Erase is supported for disk erasure | Deletion requests can be applied to backup copies and physical disk layers |
| Article 33 External Leakage Notification (72 hours): External leakage incidents must be reported to the supervisory authority within 72 hours, and incident records must be retained in | QuLog Center centralized logs and incident notifications. | The incident occurrence time, scope, and affected targets must be recorded and available for review to support timely reporting and internal documentation requirements. |
Minimum contact principle: dual-layer implementation of access control and tamper prevention
GDPR Article 5(1)(f) requires the prevention of unauthorized processing. QNAP integrates RBAC role-based permissions with AD, Azure AD, or LDAP, allowing permission mobility to be centrally managed within existing domain account systems, and further uses QNAP Authenticator multi-factor authentication to secure the login process.
For the concept that “even administrators should not be able to tamper with it” data, for example, as a backup copy for legal compliance, QuTS hero WORM enforces locking at the file system level, making it impossible for anyone to modify or delete within the retention period; QuObjects S3 Object Lock at the object storage end has obtained Veeam Ready – Object with Immutability Certification.
Learn More: QNAP Immutabilitystorage, Immutable Backup and Immutable Snapshot
Encryption: Makes leaked data unintelligible
GDPR Article 32(1)(a) lists encryption as a recommended technical measure. The value of encryption is most evident during incidents, as even if data is unfortunately leaked, the encrypted data remains indecipherable to unauthorized parties, greatly reducing the actual harm and risk caused.
QNAP provides AES-256 encryption for shared data folder / LUN, and supports Self-Encrypting hard disk drives (SED), covering TCG-OPAL, TCG-Enterprise, as well as TCG-Ruby designed for new-generation storage such as NVMe. Encryption and decryption are handled directly by the hard disk drives controller, and the key never lands in the operating system.
At the same time, SED and volume encryption both protect data-at-rest data. When a disk is stolen, lost, sent for repair, or replaced and leaves the premises, the data on the disk remains in an unreadable state, which is when Section 34(3)(a) comes into play.
Learn more: QNAP QuTS hero data Protection and Security Mechanism
Continuous Integrity and High Availability
GDPR Article 32(1)(b) uses the term “ongoing,” so integrity and availability cannot be established only on the day of the audit. The ZFS file system of QuTS hero calculates checksums for each data block, storing them separately in an upper-level index structure from the data itself. During reads, it automatically compares and detects mismatches, then repairs using parity or mirrored copies, preventing silent data corruption from accumulating.
In addition, QNAP simultaneously provides high availability solutions of various scales
-
Dual Controller Architecture: ES2486AFdc and other model adopt a dual active (Active-Active) controller design, equipped with the same ZFS-based QES operating system. Both controllers operate simultaneously, and if one fails, the other automatically takes over. NVRAM modules are included to reduce the risk of data loss during power outages due to write cache loss.
-
Dual Machine Failover: QuTS hero model can be paired with High Availability Manager, allowing two independent NAS to form an Active-Passive cluster for mutual backup. When the primary machine encounters an issue, the standby machine automatically takes over services.
-
Scale-out cluster architecture: QNAP horizontal expansion storage solution adopts QuTS MEGA operating system, with a minimum of 3 nodes to form a cluster and up to 96 nodes for expansion; through erasure coding, multiple nodes can fail simultaneously without losing data, and when a node fails, data can be automatically detected, rebuilt, and services migrated. It is suitable for PB-level data scale with high availability and flexible expansion requirements.
Recoverability: The speed of recovery determines the extent of damage an incident can cause to customer rights.
According to Article 4(12) of the GDPR and EDPB guidelines, once data is locked or destroyed, a data breach incident is established. Although the speed of restoration does not determine whether it is a breach, it directly affects the outcome of the risk assessment: if restoration is fast enough and the risk assessment for data subjects' rights is low, the incident may remain at the internal record level (Article 33(5) requires all incidents to be recorded internally); if restoration is slow and personal data cannot be retrieved for a long time, it may trigger the obligation to notify the supervisory authority and even to notify data subjects one by one.
In the same ransomware attack, the difference in recovery capability will be equal to the difference between an "internal log entry" and a "news headline".
QNAP provides a comprehensive Backup and Recovery solution:
HDP for Business* End-to-end backup solution: centralized protection for Windows, VMware, Hyper-V, Proxmox VE, and Microsoft 365, designed according to the 3-2-1-1-0 backup principle, combined with Immutable Backup and Airgap+ physical isolation backup nodes, while providing zero-error recovery verification. Through Video Verification, the boot process of backed-up VMs is automatically recorded as integrity evidence, ensuring backup availability and recoverability.
*HDP for Business Coming soon. Please refer to official announcements for the official release date.
HDP Recovery Media Creator: Windows bare metal restore standalone tool, no need to pre-install agent software to create USB or ISO recovery media; ISO can be mounted to Virtualization Station for booting, allowing real-world verification of backup data recoverability in isolated environments, and is also suitable for data center environments with BMC/IPMI remote recovery support.
Storage Expiry and Deletion Rights: Make “deletion” a system action, rather than a pending task.
The retention limitation under Article 5(1)(e) of the GDPR storage is most easily overlooked in practice when it comes to backup copies. Even if data is deleted from the primary system, several versions may still remain in the backup. QNAP provides HBS 3 backup and snapshot retention policies that allow you to set the number of versions and retention days, with automatic deletion upon expiration, ensuring that deletion strategies also cover backup layers. When the data data subject exercises the right to erasure under Article 17 or when disks are replaced or decommissioned, QNAP also supports Secure Erase to ensure that personal data will not leak with old hard disk drives devices.
Enterprise notice: Please be reminded that WORM and delete rights are inherently in conflict. Even data super administrators cannot delete data during the lock period. Therefore, the WORM retention period should be set according to your organization's data retention policy, not simply as “the longer, the safer.”
Event log: 72-hour countdown starts from the moment of “discovery”
The GDPR Article 33 gives organizations only 72 hours to report, and the report must include facts such as when the incident occurred, which data were affected, and the scope of impact. QTS/QuTS hero native logs record user access and system events; when managing multiple unit, QuLog Center can centrally aggregate daily logs and supports tagging and advanced search, so event investigations do not require piecing together data across systems. All events (including minor incidents that do not reach the reporting threshold) must be internally logged in accordance with GDPR.
Next step: Build an enterprise-level storage environment with "default privacy"
Enterprises can use the checklist in this document as a reference, and for each item, ask themselves two questions: "What mechanism do we currently rely on to implement this?" and "In the event of an audit or incident, what evidence can I provide?"
When enterprises implement, model selection, backup architecture, and HA scale must still be adjusted according to the actual data volume and budget of the enterprise; there is no one-size-fits-all configuration suitable for organizations of all scales.
With QNAP's flexible system architecture and comprehensive product line, enterprises of all sizes can transform the technical measures required by GDPR into practical defenses, building a data protection architecture that is both secure and scalable.
If you have planning, model selection, or customization needs, please contact QNAP sales or technical consultants to plan the most suitable product portfolio according to your actual requirements.
