Securiti Named a 2022 Cool Vendor in Data Security by GartnerDownload Now
Published on November 28, 2021 AUTHOR - Privacy Research Team
The consistent increase in frequency and severity of data breach incidents, coupled with the introduction of data privacy regulations such as GDPR and CCPA (recently amended by the CPRA), is encouraging organizations to revisit their privacy operations and how they handle their consumers’ personal information.
The quest for better handling, management, and protection of consumers’ personal information begins with fully understanding the concept of “CCPA Data Discovery” and following the step-wise process to ensure CCPA compliance.
Organizations are churning out 44 zettabytes of data on an average daily basis, and the number just keeps increasing every year. However, the mass production of data isn't the primary concern here. Rather, a significant volume of data is in an unstructured format, scattered across emails, spreadsheets, invoices, IoT, or rich media. IDC forecasts that 85% of data will be in an unstructured format by 2025.
A robust data discovery mechanism can help organizations gain high visibility into where the data resides in structured and unstructured systems, classify that data, catalog it under a single repository and tag it according to its regulatory status and its sensitivity and confidentiality. With this classification, organizations determine the security posture of the residing data in their hyper-scale environments and set security measures accordingly.
Moreover, there's a lot of ambiguity involved when it is about PI or sensitive information. Just about anything can be deemed PI, such as name, email address, social security number, credit card number, consumers' location, biometrics information, etc. With traditional discovery practices, IT teams tend to get lost in the ambiguity that the definition of PI carries under the CCPA regulation, which ultimately gives rise to false positives.
Consequently, IT teams spend 25% of their time and effort wading through false positive or false negative alerts, which drastically affect their productivity and the ability to take timely measures.
Smart data discovery systems help organizations save time by efficiently reducing ambiguity and resolving false positives using contextual analysis, artificial intelligence, and machine learning.
Higher accuracy in data discovery further enables organizations to ensure optimal security posture and practices and compliance with CCPA regulations.
Data discovery is how businesses collect data from different sources, analyze it, and link it to a consumer. This process allows the data to be properly discovered, cataloged, and protected to stay compliant with privacy regulations. Following are some of the ways data discovery helps organizations remain compliant with the CCPA.
As per CCPA Section 1798.140(o)(1), the term personal information is defined as information that identifies, relates to, describes, or is reasonably capable of being associated with, directly or indirectly, a particular consumer or household. Examples provided by the CCPA include:
Thus one of the most crucial parts of CCPA compliance is finding and linking the personal information of consumers within your systems to its owners. Data discovery can help an organization in this process by identifying data, classifying it, and then linking it to the owner of the data through effective data mapping. It can also help visualize the data sprawl by identity and identify compliance risks based on a subject’s residency, as per the CCPA.
The CCPA grants several data privacy rights to consumers. Consumers (i.e., data subjects) can submit a simple Data Subject Request (DSR) via a form, such as available, on the organization’s website. As per the CCPA, consumers have the right to access their personal information from the organization or to have it deleted. Consumers may also request to opt-out of the sale of their personal information. CCPA DSR requests must be honored by organizations within a period of 45 days or risk non-compliance. In order to honor a DSR, organizations can incorporate data discovery to not only detect all the data but also link it to the owner.
As per Section 1798.150, a consumer who had his unencrypted or unredacted personal information breached may sue the business for the violation of their duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information.
Therefore, organizations need to have a sound grasp on all their data and know where the data resides in their plethora of systems and servers so that they may determine risk severity and apply appropriate and reasonable security controls. Data discovery thus helps simplify this process and makes it more cost-effective and less error-prone while reducing legal risks for the business.
With data in a constant flow, in and out of the organization, there needs to be a system that constantly tracks and monitors all of this data due to modern processing activities. It further helps discover new types, categories, and data flow risks on an ongoing basis - which can then be used to update the privacy notice as per transparency requirements imposed by CCPA Section 1798.100 and 1798.115 read with Section 1798.130(a)(5).
Goals of successful data discovery include:
Securiti is the complete 360-degree solution that allows organizations to comply with global privacy regulations such as the CCPA and GDPR. The Securiti data discovery solution offers organizations the following functionalities to help them with compliance:
To learn more about the solution and how Securiti can help, request a free demo today!
June 21, 2022
When the California Privacy Rights Act (CPRA) comes into effect, replacing the existing California Consumer Privacy Act (CCPA), organizations will have to change their current business practices around personal information handling. One significant change will be Regular Risk...
June 20, 2022
Privacy laws and regulations are enacted to bring transparency and accountability to an organization’s behavior when it comes to collecting and processing users’ personal data. Before the introduction of the GDPR article 30, accountability and transparency associated with...
PO Box 13039,
Coyote CA 95013