GDPR compliance in Databricks starts with knowing exactly where personal data lives and who can touch it. Uncontrolled permissions are a direct risk. Every user identity, every workspace, every cluster must be mapped against defined data policies. Without strict configuration, even a single misaligned role can expose sensitive EU data and invite fines.
Access control in Databricks is enforced through workspace permissions, cluster access modes, table ACLs, and credential passthrough settings. To meet GDPR standards, you must combine these controls into a structured, least-privilege model. Start by enabling Unity Catalog for central governance. Assign data permissions at the catalog, schema, and table level. Ensure all identities come from a vetted identity provider with multifactor authentication enabled.
Audit every permission grant. Use Databricks’ built-in audit logs and push them to a secure, immutable storage account. Verify that logs capture read and write actions against datasets containing personal data. GDPR requires evidence of compliance, not just the intent.
Secure clusters with Single User access mode when handling regulated data. This blocks lateral movement between users and ensures only the intended identity runs queries. Combine this with credential passthrough to map workspace permissions directly to data source access. This eliminates shadow credentials and keeps authentication consistent.