Protecting personal sensitive data security in the cloud with blockchain

Reeta Sony A.L - National Law University, New Delhi, India. E-mail:reeta.sony@nludelhi.ac.in.Sri Krishna Deva Rao - Professor, National Law University, New Delhi, India. E-mail: psrikrishnadevarao@gmail.com.Bhukya Devi Prasad - Council of Scientific and Industrial Research, New Delhi, India. E-mail: bdeviprasad@csir.res.in. Cloud computing refers to anything that involves delivering hosted services over the Internet. It is fast, cheap, flexible and elastic in nature. In spite of its benefits, cloud computing raises risks for data protection and privacy. One key issue presented by cloud computing is the fact that it changes our thinking of what we consider to be "our data" Data is no longer physically stored on a specific set of computers or servers, but is rather geographically distributed. The globalised nature of cloud computing poses a challenge for personal data protection, which requires a clear location for personal data, an identification of the processor and a responsible individual for data processing. Cloud data can be misused and/or shared with third parties without prior knowledge or consent of the data owner. The direct participation of an individual in transborder data transfer, third party participation in data storage, the processing and transmission of dataand, finally, negligence of data protection due diligence from cloud service providers, makes data protection and privacy laws more relevant. The recent PRISM surveillance programme scandal at the US National Security Agency (NSA) demonstrated the privacy risks that citizens around the world take on when their personal informa­tion is stored and processed in the cloud. This situation requires awell-established techno-legal solution along international standards. India, unlike the European Union, has no dedicated regulatory framework to deal with privacy and personal data protection. Although cloud computing is still in its initial stages in India, existing laws for people who are currently using facilities offeredby cloud service providers are extremely inadequate. However, cloud computing requires legal protection in India under the country's data protection laws, privacy laws and data breach laws, which must meet "international standards'! It is the right time for the Indian government to enact appropriate regulatory frameworks to protect personal data and privacy in the cloud era. The overall objective of this paper is to understand the impact of cloud computing on privacy and personal data protection and to analyse present legal frameworks governing privacy and personal data protection in India and Europe.

The article examines the current state of legislation governing the protection of personal data, the challenges arising in its implementation, and the prospects for improving the protection mechanism through the use of blockchain technology. Frequent cases of unlawful dissemination of personal data in Kazakhstan are directly linked to unresolved issue of cybersecurity and the need to address vulnerabilities in the existing legislation, which underscores the relevance of the chosen research topic. The purpose of this study is to establish a legal framework for the protection and security of personal data through the use of digital technologies. The scientific novelty of this work lies in the fact that, for the first time since the formation of the legislative framework governing personal data in the Republic of Kazakhstan, legal norms regarding personal data have been defined, as well as areas of legal regulation for the circulation of certain types of personal data. Measures to improve existing legislation governing the circulation of personal data have been proposed. The above constitutes a national scientific doctrine in the field of personal data protection. New practical conclusions have been summarized, allowing for the improvement of existing national legislation and, consequently, their application in legislative activity. The research methods used include a general logical approach (induction, deduction), systematization, analysis, formulation, scientific methods, and empirical methods. Ensuring the security of personal data is a state obligation arising from the duty to protect individual human rights; therefore, the authors emphasize the particular importance of strengthening control over digital threats and introducing a procedure for assessing their impact on human rights in accordance with international standards. The study concludes that the Republic of Kazakhstan should accede to international instruments establishing standards for the protection of personal data. A potential pathway for strengthening the legal framework on personal data protection lies in establishing systemic safeguards that restrict unauthorized access to information. Such mechanisms should operate across all levels of data governance, ensuring consistent compliance among data holders, processors and supervisory entities. Based on the results of the research, it is proposed to adopt a legal norm regulating continuous control and monitoring by data owners, operators, and persons responsible for organizing the processing and storage of personal data.

JCDC: A blockchain-based framework for secure data storage and circulation in JointCloud

In practice, cases of buying and selling databases containing personal data are still found. Typically, personal data is sold through dark web sites or illegal data trading forums on the internet, such as breached forums. The purpose of this research is to review and analyze personal data protection regulations in accordance with Law Number 27 of 2022; analyze misuse of personal data protection; and analyze future regulations related to personal data protection. This research is a normative juridical research type. The results show that the personal data protection regulations in accordance with Law Number 27 of 2022 concerning Personal Data Protection indicate that the legal purpose of the enactment of Law Number 27 of 2022 concerning Personal Data Protection in cases of criminal acts of personal data trading on digital platforms is to ensure that personal data collected by companies or institutions is processed fairly, securely, and in accordance with applicable law. Misuse of personal data protection includes: submitting false administrative requirements, creating fake accounts, acting as someone else, illegal data trading, bullying and sexual harassment, and information theft. Future regulations related to personal data protection can be implemented in several ways. First, tightening regulations. Second, increasing awareness and education. Third, developing technology for privacy. Fourth, increasing international cooperation; stronger international cooperation on data protection and privacy will be crucial. Fifth, ethical data use.

This study focuses on the data protection of Indonesian citizens in transborder personal data transfers between Indonesia and Japan, which is increasingly relevant in the era of global connectivity and digital advances. Concerns about protection of personal data and security of personal data is increasing following existing progress. This research uses a comparative juridical approach, which allows for a comparison between the legal and regulatory frameworks protecting personal data in the two countries and conducts a comparative study of the two principles. The findings from this study show that Indonesia and Japan have implemented laws to protect the personal data of their citizens. Although there are similarities in the protection of personal data, there are differences in the mechanisms governing the requirements for transborder transfers of personal data between the two countries. This study uses a descriptive-analytic method to provide an overview and analysis of the application of regulations based on applicable legal provisions. The main objective is to analyze the differences and similarities between the two laws to draw general conclusions regarding the approaches and rules applied to the protection of personal data in Indonesia and Japan. Thus, this research provides important insights into the safeguarding of personal data in the context of transborder data transfers between the two country.This study focuses on the data protection of Indonesian citizens in transborder personal data transfers between Indonesia and Japan, which is increasingly relevant in the era of global connectivity and digital advances. Concerns about protection of personal data and security of personal data is increasing following existing progress. This research uses a comparative juridical approach, which allows for a comparison between the legal and regulatory frameworks protecting personal data in the two countries and conducts a comparative study of the two principles. The findings from this study show that Indonesia and Japan have implemented laws to protect the personal data of their citizens. Although there are similarities in the protection of personal data, there are differences in the mechanisms governing the requirements for transborder transfers of personal data between the two countries. This study uses a descriptive-analytic method to provide an overview and analysis of the application of regulations based on applicable legal provisions. The main objective is to analyze the differences and similarities between the two laws to draw general conclusions regarding the approaches and rules applied to the protection of personal data in Indonesia and Japan. Thus, this research provides important insights into the safeguarding of personal data in the context of transborder data transfers between the two country.

The rapid adoption of cloud computing has transformed the way data is stored, shared, and accessed across organizationsand individuals. Despite its scalability and cost efficiency, cloud storage introduces serious security and privacy challenges, particularly when sensitive data is outsourced to third-party cloud service providers. Traditional access control mechanisms often rely on the cloud provider’s trustworthiness, which may expose data to unauthorized access, insider threats, and data breaches. To address these concerns, CryptCloud+ is proposed as a secure and expressive data access control framework that enforces fine-grained authorization directly through cryptographic techniques. CryptCloud+ focuses on ensuring data confidentiality while enabling flexible and policy-driven access control over encrypted cloud data. The system leverages encryption-based access control, where data is encrypted before being uploaded to the cloud, and only authorized users possessing valid cryptographic credentials can decrypt and access the data. This approach eliminates the need to trust the cloud service provider, as all sensitive operations related to data access are handled at the client side. A key contribution of CryptCloud+ is its support for expressive access policies, allowing data owners to define complex rules based on user attributes such as roles, departments, access levels, or time constraints. These policies enable fine grained access control without requiring data owners to manage individual permissions manually. The framework ensures that users can access only the data they are authorized for, while unauthorized users, including cloud administrators, are unable to infer any meaningful information from the encrypted data. The proposed system is implemented using Python, taking advantage of its robust cryptographic libraries, simplicity, and integration capabilities. Python-based modules handle key generation, encryption, decryption, and policy enforcement, making the system modular and easy to extend. The implementation demonstrates how secure key management and attribute-based access enforcement can be achieved efficiently in a real-world cloud environment. CryptCloud+ also addresses scalability and performance concerns by minimizing computation overhead during data access. Encryption and decryption operations are optimized to ensure that system performance remains practical even as the number of users and data files increases. Experimental results indicate that the framework maintains strong security guarantees while providing acceptable response times for authorized users. In addition to security, the system enhances usability by allowing seamless data sharing among multiple users without re encrypting data for each individual. This significantly reduces management complexity for data owners while preserving strict access control policies. The system design ensures compatibility with existing cloud storage services, making itadaptable to various deployment scenarios. Overall, CryptCloud+ presents a secure, flexible, and effiient solution for cloud data access control. By combining cryptographic enforcement with expressive policy definition and Python-based implementation, the frameworkstrengthens data security, protects user privacy, and improves trust in cloud storage systems. The proposed model demonstrates the feasibility of practical, cryptography-driven access control for modern cloud environments.

Telemedicine allows patients to receive remote medical consultation, diagnosis, and treatment through a digital platform. However, with the development of telemedicine, personal data protection has become one of the main concerns. This research aims to compare the regulation of personal data protection in telemedicine services in Indonesia and the European Union. The type of research in this scientific article is Normative Juridical Research with a comparative legal approach. The data sources obtained in this paper are primary data and secondary data. The data collection method is a literature study. The data analysis method in this paper uses a qualitative approach. The results show that personal data protection in Indonesia is regulated by Law Number 27 of 2022 concerning Personal Data Protection (PDP Law). While in the European Union, Personal Data Protection is regulated in the General Data Protection Regulation (GDPR) which regulates the collection and use of personal data by organizations. Some similarities in personal data protection in both telemedicine in Indonesia and in the European Union are that the same consent requires telemedicine providers to obtain clear and explicit consent from patients. Both telemedicine providers must not disclose the patient's personal data to third parties without the patient's consent. Telemedicine providers to implement security measures to protect patient personal data. Both Indonesia and the European Union give patients the right to access, correct, delete, and limit the use of their personal data

The Quest for Information Privacy in Africa: A Review Essay

The article outlines the legal basis of the penalties for violation of the General Data Protection Regulation in the EU. The necessity of studying the mechanisms by which the procedure for collecting fines for violations in the field of personal data protection within the European Union is carried out. Provisions of the General Data Protection Regulation are analyzed in order to apply the experience of EU member states in the field of personal data protection as well as in the context of harmonization of Ukrainian legislation with EU law. The article analyzes changes in the legislation on the protection of personal data and identifies the most frequently applied penalties in the form of fines imposed on companies in countries such as Great Britain, Netherlands, and Spain. Forms of liability for violations of the Regulation are: administrative fine, warning, temporary suspension of activity, or certain actions performed by the controller or operator. In addition to the list, member states in their domestic legislation have the right to establish additional forms of liability for violations of personal data protection, if such a penalty does not contradict the GDPR. In the article, it has also been determined which violations in the field of personal data protection act as grounds for imposing fines, namely, it has been established that these are non-compliance by companies with the security of personal data, non-observance of conditions and rules regarding consent to the processing of personal data, and the subsequent use by companies of personal data of customers after the leak the period provided for their use or the transfer of customer data to third parties. As mentioned above, the adoption of the General Data Protection Regulation contributed to ensuring the stability of normative acts that regulate issues related to the confidentiality of personal data of users, as well as responsibility for the violation of rights related to such data. According to the Regulation, any information by which a person can be identified should be interpreted as personal data. The article examines the application of mechanisms for imposing fines and analyzes the circumstances that determine the extent of liability for violations in the field of personal data protection.

The presence regulations related to personal data protection in Indonesia, provide a new task for the Indonesian government.Power in terms of personal data protection Still not yet given space maximum movement related to handling model processing of personal data, including the institution given authority.This research targets existence ecosystem model formulation protection of personal data by institutions processing of personal data.The model was obtained by conducting a comparison law between Indonesia and Malaysia.This is due to Because The Personal Data Protection Law in Malaysia has enacted since 2010.Another thing worth noting apply in the Indonesian PDP Law, namely regarding articles that regulate the duties and functions of the Data Protection Officer (DPO) in terms of his obligation protect personal data in a company.In addition, adjustments and arrangements overlap the overlap understanding from the concept of personal data must aligned.Because this concept is the key decomposer overlap the overlap rule Because the ambiguity of the concept of personal data protection in each regulation legislation.Previous research only conducted research to the extent of personal data protection, not yet leading to the DPO.There is room open to conduct further research related to the role of the DPO.This research uses socio-legal research methods, by linking various discipline science to answer his research.Related to DPO regulations in the ecosystem this personal data protection , Indonesia can be called late realize the rules are different from Malaysia which has own a system personal data protection and plans to improve to keep up with developments This personal data protection system.Malaysia's protection system is in accordance with OECD regulations so that the system formed has apply well.

The financial sector, especially through online loan applications, has seen new opportunities thanks to technological advances, especially in the field of communications. Although online loans are easy to use, they also present risks regarding personal data security and unsafe lending practices. Along with the popularity of online loans, crimes in the digital world, such as data theft and misuse of information, are increasing. Although vulnerable to detrimental lending practices, especially illegal loans that have not been registered with the Financial Services Authority (OJK), people with low incomes see online loans as an attractive option. The aim of this research is to study how the protection of consumer personal data in online loan transactions is protected by law, especially considering the phenomenon of violations and unprofitable lending practices. This research examines how Law no. 27 of 2022 concerning Personal Data Protection (UU PDP) protects personal data and how it impacts borrowers socially and psychologically. This research shows regulatory and practical innovation in dealing with the problem of personal data leakage which is detrimental to consumers when borrowing money via the internet. Through regulatory analysis and case studies, this research is expected to provide insight into how effective personal data protection is in online loan transactions. Therefore, this research helps build better regulations and efforts that protect customers in the ever-growing era of online lending.

Faculty of Business and Management Sciences, Kolej Universiti Islam Perlis, Malaysia As digital technology develops globally, the protection of personal data in the commercial sector becomes extremely important. Cases of selling data to third parties are increasing, and the government is required to tighten provisions in personal protection laws. Therefore, the Personal Data Protection Act 2010 (Act 709) was passed by the Parliament of Malaysia for the purpose of regulating the processing of personal data and to prevent the misuse of the personal data in commercial transactions. The Act confers rights on Data Subjects in relation to the collection, use and or retention (processing) of their Personal Data, and places obligations on Data Users. The Personal Data Protection Order (Group Data Users) 2013 lists the categories of data users who need to register with Personal Data Protection Department. One of group data users is the education sector including educational institutions and private higher education registered under the Private Higher Education Institutions Act 1996 (Act 555). As data users, private higher education institutions are responsible for protecting Personal Data of two categories of data subjects, namely students and employees in the institution. The obligation including to exercise an appropriate policies and procedures to safeguard the Personal Data collected, to maintain data accuracy, and to prevent unauthorized disclosure. This paper aims to measure the implementation of personal data protection laws including the formulation of operational policies and procedures in private higher education institutions. This will be done by looking at the provisions from the Act regarding the principles of data protection as well as the duties for compliance to the legislation. Furthermore, non-compliance of the Act commits an offence and on conviction, be liable to a fine not exceeding RM500,000 or to imprisonment for a term not exceeding 3 years or both. The study also seeks to determine what are the challenges in implementing the Act successfully.

The article examines the problems and perspectives of unification of national legislations on personal data protection in the Eurasian Economic Union (EAEU). The “Digital Agenda of the EAEU until 2025” determines the development and adoption of the Agreement on data circulation, including personal data as one of the main priorities. The adoption of this Agreement is relevant due to lack of a unified act regulating personal data protection in the EAEU. The right to privacy is established in the constitutions of all EAEU member states. This right includes the right to personal data protection. The development of digital platforms, providing services in digital format, cross-border transfer of personal data in the field of labor migration, social security and online trade makes the necessity of unification of legal framework on personal data protection in the EAEU member states relevant. The author examined the basic legal acts on personal data protection in the EAEU, determined similarities and distinctive features of legal regulation of collection, processing and protection of personal data, identified problems, and proposed recommendations for unification of national legislations on personal data protection in the EAEU.

With the development of computing and communication technologies, an extremely large amount of data has been collected, stored, utilized, and shared, while new security and privacy challenges arise. Existing access control mechanisms provided by big data platforms have limitations in granularity and expressiveness. In this article, we present SparkAC, a novel access control mechanism for secure data sharing and analysis in Spark. In particular, we first propose a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">purpose-aware access control</i> (PAAC) model, which introduces new concepts of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">data processing purpose</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">data operation purpose</i> and an automatic purpose analysis algorithm that identifies purposes from data analytics operations and queries. Moreover, we develop a unified access control mechanism that implements PAAC model in two modules. GuardSpark++ supports structured data access control in Spark Catalyst and GuardDAG supports unstructured data access control in Spark core. Finally, we evaluate GuardSpark++ and GuardDAG with multiple data sources, applications, and data analytics engines. Experimental results show that SparkAC provides effective access control functionalities with very small (GuardSpark++) or medium (GuardDAG) performance overhead.

A comparison of data protection legislation and policies across the EU