Handling on-premises data with strict data protection policy in Power BI

[GopyJS]

Hello, PowerBI community,

I am a Power BI developer based in India, and I am going to work with a client in the Republic of Congo, Western Africa. The client has a strict data protection policy that prohibits the sharing of data outside the country due to regulatory requirements. However, the data needed for the Power BI report is stored on-premises, posing a challenge for me.

I would like to seek your guidance on how to handle this situation effectively. Are there any recommended approaches or best practices for working with on-premises data in Power BI while complying with strict data protection policies? Additionally, if there are any specific considerations or constraints, I should be aware of, please let me know.

Thank you in advance for your assistance.

[TomMartens · Accepted solution]

Hey @GopyJS ,

because of the requirements regarding the data residency, it is a must that your client provides you with a virtual machine located in the environment of your client. You can not use your local machine (located in India) because data will travel to your local machine as soon as you use Power BI Desktop to connect to the data.

You have to clarify with the your client if this is sufficient, because it's simply not possible to prevent you from taking a picture of the using an external camera.

Regards,

Tom

[GopyJS]

"Hello @TomMartens,

Thank you for your valuable insights regarding the handling of on-premises data with strict data protection policies in Power BI. Your expertise has been extremely helpful in guiding our approach.

In the context of sensitive bank data, our client in the Republic of Congo has expressed concerns about providing access to their data. They are worried about the possibility of accidental or intentional data deletion by the developer. Considering these concerns, is there a way to grant read-only access to the Power BI developer while ensuring the integrity and security of the data?

We want to ensure that the developer can effectively work with the data for report development purposes but without the ability to make any changes or delete any data within the system. Any insights or recommendations you can provide on granting read-only access to the Power BI developer would be greatly appreciated.

Thank you once again for your time and expertise.

[TomMartens · Accepted solution]

Hey @GopyJS ,

assuming data source is SQL Server, then it's absolutely sufficient to add a database role that "determines" the artifacts the developer needs to READ. Then adding you to the role.

Developing a Power BI Solution (dataset and visualizations) does not require WRITE permission on the data source.

Please be aware that there is this saying:
"Data should be transformed as far upstream as possible, and as far downstream as necessary."
This phrase was coined by Matthew Roche, one of the members of the Power BI CAT team (https://ssbipolar.com/2021/05/31/roches-maxim/).
This measns, if you need a new column, ask the database team, if they can add this column in the database.

By no means, you should have write permissions to the source data, no matter if the data source is a SQL Server or a folder in a SharePoint Library.

Hopefully, this answers your question.

[TomMartens · Accepted solution]

Hey @GopyJS ,

because of the requirements regarding the data residency, it is a must that your client provides you with a virtual machine located in the environment of your client. You can not use your local machine (located in India) because data will travel to your local machine as soon as you use Power BI Desktop to connect to the data.

You have to clarify with the your client if this is sufficient, because it's simply not possible to prevent you from taking a picture of the using an external camera.

Regards,

Tom

[GopyJS]

@TomMartens 
Thank you so much for your valuable advice regarding the handling of on-premises data with strict data protection policies in Power BI. Your insights have provided me with a clear direction on how to address this challenge.

I truly appreciate your expertise and guidance. I will promptly convey your answer to our client in the Republic of Congo and discuss the best way to proceed based on your recommendations. Your input will undoubtedly be instrumental in finding an effective solution that aligns with their data protection requirements.

Once again, thank you for your time and support. Your contribution to the Microsoft community is greatly valued.

[TomMartens]

My pleasure!