Hull College automates data retention workflows for continuous GDPR compliance

Challenge

• Enforce GDPR retention requirements for millions of student records
  Hull College stores millions of files containing students’ personal information. To comply with GDPR data retention rules, the IT team needed complete visibility into these files and the ability to enforce proper retention periods. To ensure accuracy and avoid delaying other IT initiatives, they sought to automate data discovery and classification.
• Respond to DSARs efficiently at scale
  The college must handle data subject access requests (DSARs) quickly and accurately. Given the volume of stored data, manual searches were not feasible. The IT team needed an automated way to locate regulated information across all systems.
• Strengthen security by detecting high-risk activities
  To better protect sensitive resources, the IT team wanted insight into unusual activity across the environment. They needed alerts on critical events — including privilege escalation, attempts to access financial or HR data, and suspicious file deletions — to quickly mitigate potential threats.

Netwrix solution

John Bayes, IT Director at Hull College, chose Netwrix over other solutions because of how much it can do right out of the box and how easy it is to configure and use. It was important for him that the learning curve be minimal, since his team was already overwhelmed.

• Improved data governance. John immediately used Netwrix Data Classification to scan the college’s file servers. After consulting with the data owners, he was able to archive over half of the records, since they were no longer required, and put appropriate retention policies in place for the rest of the files. John also classified all documents containing students’ PII and can now easily ensure that they are stored only in secure locations.
• Streamlined response to DSARs. Netwrix Data Classification also helps the IT team efficiently find and export all personal data associated with an individual who submits a DSAR. In fact, it typically takes just 5 minutes to kick off a search and get back all the relevant records. As a result, John can ensure that the organization fulfills its privacy obligations without delaying other projects.
• Improved incident detection. Daily reports from Netwrix Auditor summarize what users are up to across the IT environment and highlight areas that might require prompt attention, such as privilege elevations, modifications of virtual machines and changes to sensitive data. John also values the alerts on anomalous user behavior, such as multiple failed logons and attempts to access financial or HR folders, which help him spot malicious actors before they can inflict real damage.

Key benefits

• Automates data retention workflows
• Speeds processing of DSARs
• Alerts on potentially harmful activity