Accelerating business value with PrivacyOps

Common denominators: identifying the key principles of data privacy

But what, exactly, is the common denominator across these increasingly diverse data protection and privacy mandates? It is often easier to get caught up in the individual nuances and “checkbox” requirements of each than it is to identify core underlying principles. Identifying differences can give the organization a deceivingly simple “to-do” list that misses the big picture. In reality, data privacy and data protection regulations fundamentally exist to protect the rights of individuals, and to protect the rights of individuals, organizations need full control of ALL the personal data in their possession.

Across data privacy and protection regulations, individuals are generally given the “right to know” and the “right to say no” with regard to their data. The right to delete personal data, the right to data portability, the right to reasonable security for personal data, and the right to be notified in the case of a data breach are also all very common. Again, organizations must have a very granular understanding of what personal data is in their possession and what is happening to it at all times if these basic rights are to be fulfilled. Not knowing is not an excuse.

Challenges with data privacy in the modern IT ecosystem

Unfortunately for businesses, data is more difficult to control and understand than ever before. Once personal data is ingested into an organization, it propagates into countless internal systems and data silos, and can make its way to dozens or even hundreds of third-party vendor systems that the original organization has limited control over. A growing number of end users demanding data within organizations also complicates the management of appropriate access and permissions.

And the diversity of the average business IT environment is simply staggering. According to 451 Research’s enterprise practitioner survey results, 72% of organizations that use the public cloud use more than one public cloud vendor, and a total of 8% used more than three public cloud vendors: an impressive feat considering only three public cloud providers dominate the market in the US. For organizations with 1,000+ employees, a full third – 33% -- report having more than 50 distinct departmental data silos. That’s a lot of disparate data sources to manage.

A data storm is brewing

These factors amount to a perfect storm. Growing public outrage and awareness, proliferating regulations, sprawling IT ecosystems, an expanding pool of self-service data consumers, and the intensifying enterprise pressure to extract maximum insight from all available informational resources.

We’re at the end of an era; gone are the days where “reactive” business functions such as compliance and data privacy could be at odds with more “proactive” enterprise insight initiatives such as analytics and data science. In an era of rapid disruption, organizations that want to survive must align their business objectives such that data privacy and protection is no longer a burden or cost center. Rather, it must be an accelerator for better data management architecture and practices which will benefit all stakeholders.

The operationalization of responsible data use

In this context, data privacy and protection efforts are deeply intertwined with the viability of the business and the ability to meet the needs and expectations of customers: particularly in the B2C space. So, it should go without saying that data privacy and data protection needs to be an ongoing, iterative, adaptable process rather than a project-based “checkbox” approach with a deadline. New regulations will always emerge; it is up to organizations to implement processes and technology that can support evolving needs rather than just the specifications of a single law.

Automation will be critical. There is no amount of human talent and effort sufficient to scale to the data management volume challenges within a typical modern organization. There is simply too much data to evaluate and protect. Capabilities such as automated detection of potentially-sensitive data sources, automated policy controls for data, automated control of data access rights, and automated fulfillment of data subject access requests (DSARs) are all possible and – increasingly – necessary.

The PrivacyOps concept and framework looks to operationalize data privacy practices across the organization, leveraging automation, so that not only compliance objectives can be met, but so that the friction of end user data access and leverage can be reduced. Better data management and data privacy controls, when implemented correctly, can actually free up data that was formerly locked away in silos. To the average business end user, such as a data analyst, an effective PrivacyOps program will be invisible and simply make access to appropriate data sources quicker and more seamless.