Top 3 data privacy challenges and how to address them
There are many issues enterprises face in their data privacy programs. Read on for how to address the most common three found across organizations.
Data privacy -- driven by regulatory requirements, personal data growth and customer expectations -- is at the forefront of our digital world. Adhering to these measures and implementing effective privacy management across an enterprise presents a number of data privacy challenges.
What is data privacy?
Data privacy refers to the right of an individual to keep his or her information private. It advocates individual control over the collection and use of private information with the goal of protecting the confidentiality of an individual.
Personal private information, often referred to as sensitive data, relates to individuals and should be protected against unauthorized disclosure. This includes informing customers of privacy policies and practices and avoiding the disclosure of nonpublic personal information to third parties without consent.
Don't confuse data privacy with data security. Although both practices protect data, they have different objectives. Think of data privacy as protection from unauthorized disclosure and data security as protection from unauthorized access.
This article is part of
What is data protection and why is it important?
Why is it important?
Sensitive data is prolific across all facets of our digital lives. The number of occurrences increases the risk of unauthorized disclosure. Consequently, privacy breaches are all too common. Failure to protect private information from such breaches can affect both individuals and organizations.
The potential harm to an individual if their information were improperly disclosed can result in identity fraud, reputational damage, financial loss or discrimination.
Organizations are subject to data privacy regulations and data protection laws as well as customer privacy conditions. They have the responsibility to keep information private and can suffer consequences for noncompliance, including monetary fines, brand damage, legal action and business loss.
Successful organizations view data privacy not as a cost of doing business but rather a capability that is a competitive differentiator in winning and retaining business.
What is a data privacy program?
To gain an appreciation of data privacy challenges, you need to understand the complexity of a data privacy program. Don't underestimate the overhead of people, processes and technology. The ability to deliver and enforce data privacy is a risk management effort that aims to improve individual confidentiality by reducing risk exposure.
Data privacy challenges
Although privacy priorities vary from one organization to another, data privacy challenges often involve operationalizing a data privacy program. Government regulations, customer mandates and corporate policies provide principles, guidelines and requirements describing the objectives of data privacy but do not prescribe how to implement a successful program.
Here's a look at a few common data privacy challenges and how to improve your data privacy posture.
1. Inventory challenge
In many organizations, sensitive data is pervasive across systems on premises, at managed providers and in the cloud -- more so for organizations with older or legacy systems where it is often difficult chasing a long history of sensitive data proliferation.
The challenge is finding the data, understanding its lineage and keeping track of it in a dynamic environment. You simply can't protect what you don't know about. Operationalizing data privacy starts with inventory tracking of sensitive data elements.
Data inventory tracking is analogous to a library catalog system. Can you imagine a library without a current catalog? It would be chaos! This is the glue that holds the entire library system together.
Identifying and tracking sensitive data is no different. To successfully deliver this capability, you must implement an active inventory system that automatically tracks where sensitive data resides throughout its entire lifecycle, from inception to disposal. At its core are two components: an up-to-date data catalog as well as discovery tools to scan structured and unstructured data stores and locate sensitive data with direct and inferred matching.
Having an active inventory, you not only know with confidence what sensitive data elements exist and where, but you have the ability to manage this data throughout its lifecycle by using the metadata in the catalog.
2. Design challenge
As the awareness and consequences of unauthorized disclosure have grown, so has the need to apply a smart, sustainable design to systems with data privacy as a priority.
The challenge is how best to operationalize privacy principals in modern systems and retrofit older systems. For new systems, data privacy should be baked into the core system design on day one. For older, legacy and commercial systems, data privacy processes should be built on to the core system. In either case, look to find the right balance between data privacy and usability by protecting sensitive data without inhibiting business processes.
The key to a successful data privacy design is automation rather than brute force. Periodic or passive, error-prone manual processes simply can't keep up with a digital-infused world. A passive privacy design, at almost any scale and velocity, is not sustainable and is a non-starter. Technology automation is key to keeping the data privacy ecosystem synchronized at all times.
Automated privacy processes should be implemented throughout the software development lifecycle. These processes include inventory tracking, continuous integration and delivery, real-time consent verification, monitoring of policy violations and data retention.
To succeed in this you must protect sensitive information as soon as possible -- preferably immediately after collecting the data. It's also important to remove sensitive data in compliance with data retention policies and create a data privacy compliance checklist for vetting systems and third-party data sharing to ensure they meet privacy engineering objectives.
3. Remediation challenge
Many organizations are faced with the problem that their amount of sensitive data is unmanageable. This is especially true for organizations with large application portfolios, lax data practices, non-standard data modeling, antiquated architectures and systems carrying technical debt from changed business processes. Contributing to this dilemma is the expansion of systems off premises to managed providers and the public cloud.
The challenge is to establish a smaller perimeter around sensitive data by removing occurrences of unnecessary sensitive data and rebuilding application architectures. Look to target systems in which the use of sensitive data cannot be rationalized or can be optimized with modern architecture.
These include:
- Systems that have changed unique personal identification from personal information to alternate surrogate identifiers;
- Systems that carry sensitive data out of convenience as data was propagated throughout the architecture;
- Systems supporting business processes that have changed and no longer use sensitive data; and
- Systems that store sensitive data locally and can rearchitect to access a centralized master data management system.
Control of source code and API integration are important factors in remediating sensitive data. In-house applications will make it easier to modify. Open source and third-party commercial software products may be more difficult or impossible to modify.
In an effort to minimize disruption and facilitate implementation, look to keep file, schema and message formats intact and clear sensitive data values by assigning null or blank values rather than deleting the data element itself. As for redesigning systems, look for modular systems that can plug-and-play access to data.
