A Policy-Driven Data Protection Architecture for Consumer-Facing Cloud Application Systems

Abstract

Consumer-facing cloud application systems, handling vast quantities of sensitive personal data, are subject to stringent regulatory compliance (e.g., GDPR, CCPA) and escalating cyber threats. Traditional security models struggle to enforce granular data protection policies consistently across distributed microservices and diverse cloud data stores. This paper proposes a Policy-Driven Data Protection Architecture (PDDPA) that centralizes the definition of data protection rules and decentralizes their enforcement across the application stack. PDDPA employs a declarative Policy-as-Code (PaC) framework as its core, integrating with data classification, encryption, tokenization, and dynamic data masking (DDM) techniques. The architecture leverages a Data Protection Gateway (DPG) as a ubiquitous Policy Enforcement Point (PEP) across all data access pathways. An empirical evaluation, conducted on a simulated e-commerce platform handling PII, demonstrates that PDDPA achieves $100\%$ compliance with simulated data access policies, including role-based access to PII and masking of sensitive attributes. Furthermore, the modular design introduces a P95 latency overhead of less than $1.5 \text{ms}$ for policy evaluation, demonstrating its viability for high-performance consumer applications. This work provides a scalable, auditable, and resilient framework for safeguarding sensitive data in complex cloud ecosystems.