--- title: A thumbprint almost ended our vacation, or GDPR and the cloud description: Companies and cloud providers are in limbo due to conflicting privacy laws image: https://shardsecure.com/hubfs/thumbprint-george-prentzas-SRFG7iwktDk-unsplash-2-1.jpg --- - [Home](https://shardsecure.com/) - [Blog](https://shardsecure.com/blog) # A thumbprint almost ended our vacation, or GDPR and the cloud ![Picture of Bob Lam](https://shardsecure.com/hs-fs/hubfs/Staff%20headshots/Bob-Lam--2022--Resized%20(1).jpg?width=60&name=Bob-Lam--2022--Resized%20(1).jpg "Picture of Bob Lam") [Bob Lam](https://www.shardsecure.com/team/bob-lam) CEO and Co-Founder, ShardSecure November 15 2021 ![](https://shardsecure.com/hubfs/thumbprint-george-prentzas-SRFG7iwktDk-unsplash-2-1.jpg) A thumbprint almost ended our vacation, or GDPR and the cloud A few years ago, we surprised our youngest with a trip to Florida. We did the whole pickup-from-school-with-our-luggage-in-the-car bit and drove straight to the airport. And there was much rejoicing. It was a heady morning as we set out on the first day of our multi-amusement park weekend. We bought our tickets to the first park and headed to the turnstiles. I was the last of our trio to approach the gate and our trip almost ended right there. Why? They required me to scan my thumbprint, that’s why. “I’m sorry. You want *what?!* Why? Where is it stored? What’s your retention policy?” As I peppered the poor kid at the gate with a barrage of questions, I could see the look of exasperation on my family’s faces. So, I made a choice; I gave up a bit of my privacy in order to make memories with my family. Having control over my privacy has always been important to me, and I applaud the efforts of governments to protect their citizens’ personal information in the possession of businesses. But what happens when different regulations overlap with conflicting requirements, differing views on liability, and impose stiff penalties for non-compliance for those businesses? Until we see how strictly EU courts interpret the [Schrems II decision](https://edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer_en) on current [GDPR](https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en) guidelines on data transfers outside of the EU, European businesses and US cloud providers are both in limbo. Consider this scenario that illustrates the primary concern from the EU’s perspective: A European company stores EU citizens’ personal data in the cloud hosted by a US cloud provider. Even if the data is encrypted, who possesses the key? What’s to prevent the cloud provider – whether legally compelled, or by the behavior of a rogue administrator, or by an attacker with compromised credentials - from accessing that data? Even if the key is held by a third-party, the European Data Protection Board (EDPB) appears to lack the confidence in encryption to be a sufficient control1. The penalties for companies found in violation of GDPR may be as high as 4% of their global revenue and US cloud providers may find themselves shut out of the European market. And if there is an apparent lack of confidence in encryption, how can these organizations protect their data in the cloud? Is there a way to remove the key management issue? We believe we have an answer to those questions. Would you be surprised if I told you that answer would be to deploy ShardSecure? We invented a patent-pending technology called Microsharding that essentially makes sensitive data unsensitive and unintelligible to unauthorized users. And we do this without any concept of a key. How? Think of a paper shredder into which you feed a sensitive document: - First, we make sure the shreds (the microshards) are too small to contain any sensitive data: no birthdates, no phone numbers, no addresses. - Next, those microshards are randomly mixed into different bags (microshard containers) along with some fake microshards to complicate any attempt at reassembly. - Lastly, those bags are distributed to different places around the world. If someone is able to look at the contents of that bag, the information is incomplete and doesn’t make any sense. Think what it would take for an unauthorized user to reassemble that one file. Imagine the complexity introduced with trying to enumerate, locate, identify, and reassemble hundreds or thousands of files that had gone through the same process. Now imagine that this shredder is clustered, can synchronize multiple clusters, and performs data integrity checks. And if a site goes down or the data has in some way been altered, your data is restored automatically, and you continue operating as if nothing happened. (How we do these will be the subject of my next blog post.) Nobody, including us, can predict which way the courts may rule, and we can’t say that we will make you compliant. No vendor can claim that. What we will say is that we believe we can offer you a more secure way to protect your sensitive data in single cloud, multi-cloud, multi-region, multi-datacenter, or hybrid storage configurations. Want to learn more?  [Schedule a demo](https://go.shardsecure.com/schedule-a-demo) or meeting to discuss your requirements today.  1 https://www.lawfareblog.com/will-eu-lose-access-us-data-flows-and-software# [Compliance](https://shardsecure.com/blog/tag/compliance) [GDPR](https://shardsecure.com/blog/tag/gdpr) [Privacy](https://shardsecure.com/blog/tag/privacy) ## Read on ![](https://shardsecure.com/hubfs/Picture2.jpg) June 15 2026 ### [ShardSecure MCP Secure Gateway](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference) [Read more](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference) ![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg) February 18 2026 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Unstructured Data Left Exposed: A Cloud Breach That Should Worry Every Enterprise](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise) [Read more](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise) ![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg) November 12 2025 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Can You Really Trust Hyperscalers with Your Data at Rest?](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest) [Read more](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Acronis%20and%20ShardSecure%20unveil%20a%20groundbreaking%20technology%20partnership%20set%20against%20a%20backdrop%20of%20a%20sleek%20modern%20office%20filled%20with%20digital%20screens%20displaying%20dynamic%20data%20flows%20The%20atmosphere%20buzzes%20with%20excitement%20and%20anticipation%20illuminated%20by%20sof-1.png) October 16 2025 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Acronis + ShardSecure: Stronger data protection for modern threats](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats) [Read more](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20portrays%20a%20hightech%20digital%20landscape%20filled%20with%20abstract%20representations%20of%20data%20security%20concepts%20At%20the%20forefront%20a%20glowing%20vault%20symbolizing%20advanced%20filelevel%20encryption%20stands%20tall%20surrounded%20by%20intricate%20patterns%20of%20fragmented%20data.png) October 1 2025 | [Data Sensitivity](https://shardsecure.com/blog/tag/data-sensitivity) ### [Revolutionizing Data Security: How Agentless File Level Encryption Makes Stolen Data Useless](https://shardsecure.com/blog/sensitive_data) [Read more](https://shardsecure.com/blog/sensitive_data) ![unstructured data](https://shardsecure.com/hubfs/Digital%20image%20of%20globe%20with%20conceptual%20icons.%20Globalization%20concept.jpeg) September 15 2025 | [Cybersecurity News](https://shardsecure.com/blog/tag/cybersecurity-news) ### [Elevating unstructured data security: ShardSecure® and Entrust® Join Forces!](https://shardsecure.com/blog/entrust_partnership) [Read more](https://shardsecure.com/blog/entrust_partnership) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/scales%20%20ransomware%20attack%20to%20pay%20the%20money%20or%20risk%20the%20attack.jpeg) July 29 2025 | [Ransomware](https://shardsecure.com/blog/tag/ransomware) ### [CISOs on Strategic Considerations in Ransomware Response](https://shardsecure.com/blog/ransomware-fine) [Read more](https://shardsecure.com/blog/ransomware-fine) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Image%20for%20AI%20data%20types-1.jpeg) July 29 2025 | [Data security](https://shardsecure.com/blog/tag/data-security) ### [The Growth of AI is driving the Imperative of Securing Unstructured Data](https://shardsecure.com/blog/ai-unstructured-data) [Read more](https://shardsecure.com/blog/ai-unstructured-data) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20hightech%20digital%20landscape%20showcasing%20a%20sleek%20modern%20office%20environment%20illuminated%20by%20soft%20blue%20and%20white%20lighting%20In%20the%20foreground%20a%20large%20computer%20screen%20displays%20intricate%20graphs%20and%20charts%20related%20to%20data%20security%20while%20a%20gr.jpeg) July 22 2025 | [Data security](https://shardsecure.com/blog/tag/data-security) ### [How to make your SharePoint data of zero value in a zero day attack!](https://shardsecure.com/blog/sharepoint_breach) [Read more](https://shardsecure.com/blog/sharepoint_breach) [![ShardSecure®](https://shardsecure.com/hubfs/ShardSecure%20brand%20assets/Logo%20(2022)/ShardSecure-Logo__Horizontal--White.svg "ShardSecure®")](https://shardsecure.com/) 101 Avenue of the Americas, 9th Floor, New York, NY 10013, United States of America [![linkedin](https://shardsecure.com/hubfs/_2023/li.svg) ](https://www.linkedin.com/company/shardsecure) [![tweeter](https://shardsecure.com/hubfs/_2023/tweeter.svg) ](https://www.twitter.com/ShardSecure) [![facebook](https://shardsecure.com/hubfs/_2023/facebook.svg) ](https://www.facebook.com/ShardSecure/) [![facebook](https://shardsecure.com/hubfs/_2023/youtube.svg) ](https://www.youtube.com/@shardsecure877) © 2026 ShardSecure®. All rights reserved. [Privacy Policy](https://shardsecure.com/privacy-policy) ![websights](https://ws.zoominfo.com/pixel/62e7bb6d62a6b2008e071c83) ![](https://px.ads.linkedin.com/collect/?pid=5456580&fmt=gif) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Bob Lam", "url" : "https://shardsecure.com/blog/author/bob-lam" }, "dateModified" : "2023-09-08T14:16:24.474Z", "datePublished" : "2021-11-15T15:12:29.000Z", "headline" : "A thumbprint almost ended our vacation, or GDPR and the cloud", "image" : [ "https://shardsecure.com/hubfs/thumbprint-george-prentzas-SRFG7iwktDk-unsplash-2-1.jpg" ], "mainEntityOfPage" : { "@id" : "https://shardsecure.com/blog/thumb-gdpr", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://shardsecure.com/hubfs/ShardSecure-Logo__Horizontal--Purple-Inverted.svg" }, "name" : "ShardSecure" } } ```