With the increase in cyber security attacks and new data protection laws regulating the use of personal information. Having data protection and governance alongside your analytics is key and essential. This is why working with a consultancy with analytics and data protection professionals working side by side is paramount.
General guidance
Only include the personal information in the database that’s required (data protection minimization principle). For example, if there’s a financial reporting system the passport number, nationality, or date of birth may not be required.
In the reports and dashboards not to allow personal information to be visible unless it’s essential. Most reports and dashboards require aggregated data and personal information is not required. What I mean by aggregated is numbers counted, summed, or forming an average. For example, what is the seat utilization as a percentage for flight A compared to flight B. Or what was the total number of children travelling on the AM flights compared to the PM flights. We don’t need to know the children’s names or any other personal information just the count of children.
When reporting by age remove the date of birth as this is considered personal information. Instead create a column in the reporting data that has the age of the passenger. The age of the passenger would not be considered as personal information. It would be better to include in the reporting data that the passenger is 56 rather than using the date of birth in the form of mm/dd/yyyy.  The age could be calculated using the date of birth in the data warehouse. But only make available the age or age band in the reporting data.
When there’s a need to include personal information, include the appropriate security measures to protect the data. This can be achieved with techniques such as row level security. Row level security ensures that individual users can only see the data they need to. The security uses the email address to identify and filter the data based on what they have access to.
To comply with ISO 27001 and data protection Sensitivity Levels are required. Sensitivity levels allow an organization to categorize the content of the data with a label. Typically, these labels are confidential, private, public etc. Analytics tools like Azure services and Microsoft Power BI have sensitivity levels built in to the applications, allowing organizations to use these as part of a security strategy.
As a partner of Microsoft, with the new Microsoft Fabric analytics, data engineering, machine learning, data governance, and data compliance are all together under one platform. This allows Microsoft fabric to integrate compliance to data protection easily.