GDPR Compliance
What is GDPR?
The EU General Data Protection Regulation (GDPR) replaced the Data Protection Directive 95/46/EC. It brings data privacy laws across Europe into line, protects the personal data of people in the EU, and changes how organizations handle that data. It has applied since 25 May 2018.
Is Magnus Box GDPR compliant?
Magnus Box can be part of your GDPR-compliant backup service, but you still need to meet your own GDPR obligations. A GDPR consultant or legal adviser can help you check your setup.
Who's responsible for what
You and your clients decide what gets backed up, where it's stored and how long it's kept. Under GDPR, each client is usually the controller of its own data, and you, as its MSP, usually process that data on its behalf. Check the roles set out in your contracts with your clients.
How Magnus Box helps
- Encryption: backup data is AES-256 encrypted in transit and at rest. Encryption keys are generated automatically, and partners and end users never see or access them. See Encryption and key management.
- Data location: backup data is stored in our own facility in Saginaw, Michigan, and in Backblaze data centers. See Where is my client's data stored?. For region or data residency questions, email support@magnusbox.com.
- Deletion: when a client asks you to remove their data, you can delete their users, Storage Vaults and snapshots from the Web Portal. Use a policy to stop end users deleting backups themselves. See Policy Settings.
- Retention: retention policies control how long old backups are kept, and retention passes delete what falls outside them. See Retention policies and retention passes.
- Access control: give each client its own user account, and protect your admin sign-in with two-factor authentication. See Configure two-factor authentication.
DPAs and questionnaires
To ask about a data processing agreement (DPA), or for help with a GDPR questionnaire or other compliance paperwork, email support@magnusbox.com.