Securiti leads GigaOm's DSPM Vendor Evaluation with top ratings across technical capabilities & business value.

View

Accelerating business value with PrivacyOps

Published January 9, 2020
Author

Omer Imran Malik

Data Privacy Legal Manager, Securiti

FIP, CIPT, CIPM, CIPP/US

Listen to the content

If you’re reading this, you care about data privacy. Maybe you care about it in the scope of your job responsibilities, or perhaps you care about it personally: in the scope of your own personal life and technology use. But more likely than not, it’s a mix of the two.  This is why automation of privacy efforts – and PrivacyOps -- matters. Curious? Read on.

The cultural zeitgeist of data privacy awareness

We didn’t get here by accident. Governments around the world have not enacted data-centric regulations such as GDPR and the California Consumer Privacy Act (CCPA) out of the pure goodness of their hearts. These laws are largely in response to growing public and awareness and outcry over-exploitation of sensitive personal information: personal information that individuals feel they often have little choice in providing or controlling if they are to participate in modern society. Pick your favorite headline about a breach or data privacy violation; data privacy awareness is high and growing.

The research done by 451 Research also corroborates this. In one of our consumer survey cycles, we asked individuals how concerned they were about data privacy. A full 90% reported they were either “very concerned” or “somewhat concerned.” Only 1% reported they were “not at all concerned.”

That type of awareness is hard to ignore, and in the US, individual states are rapidly enacting legislation for data privacy and protection: following in the footsteps of California. But for businesses looking to comply with these regulations, the landscape is treacherous. Not only does California’s law – CCPA – have extraterritorial reach, but all of the individual state proposals for laws are slightly different, leading to a balkanization of data privacy and protection standards in the US. Interstate organizations in the US, then, cannot sustainably approach each new regulation with an ad hoc “Whack-a-Mole” approach. They need privacy programs that are adaptable, scalable, and that leverage automation to execute data management tasks common to multiple regulatory frameworks.

Common denominators: identifying the key principles of data privacy

But what, exactly, is the common denominator across these increasingly diverse data protection and privacy mandates? It is often easier to get caught up in the individual nuances and “checkbox” requirements of each than it is to identify core underlying principles. Identifying differences can give the organization a deceivingly simple “to-do” list that misses the big picture. In reality, data privacy and data protection regulations fundamentally exist to protect the rights of individuals, and to protect the rights of individuals, organizations need full control of ALL the personal data in their possession.

Across data privacy and protection regulations, individuals are generally given the “right to know” and the “right to say no” with regard to their data. The right to delete personal data, the right to data portability, the right to reasonable security for personal data, and the right to be notified in the case of a data breach are also all very common. Again, organizations must have a very granular understanding of what personal data is in their possession and what is happening to it at all times if these basic rights are to be fulfilled. Not knowing is not an excuse.

Challenges with data privacy in the modern IT ecosystem

Unfortunately for businesses, data is more difficult to control and understand than ever before. Once personal data is ingested into an organization, it propagates into countless internal systems and data silos, and can make its way to dozens or even hundreds of third-party vendor systems that the original organization has limited control over. A growing number of end users demanding data within organizations also complicates the management of appropriate access and permissions.

And the diversity of the average business IT environment is simply staggering. According to 451 Research’s enterprise practitioner survey results, 72% of organizations that use the public cloud use more than one public cloud vendor, and a total of 8% used more than three public cloud vendors: an impressive feat considering only three public cloud providers dominate the market in the US. For organizations with 1,000+ employees, a full third – 33% -- report having more than 50 distinct departmental data silos. That’s a lot of disparate data sources to manage.

A data storm is brewing

These factors amount to a perfect storm. Growing public outrage and awareness, proliferating regulations, sprawling IT ecosystems, an expanding pool of self-service data consumers, and the intensifying enterprise pressure to extract maximum insight from all available informational resources.

We’re at the end of an era; gone are the days where “reactive” business functions such as compliance and data privacy could be at odds with more “proactive” enterprise insight initiatives such as analytics and data science. In an era of rapid disruption, organizations that want to survive must align their business objectives such that data privacy and protection is no longer a burden or cost center. Rather, it must be an accelerator for better data management architecture and practices which will benefit all stakeholders.

The operationalization of responsible data use

In this context, data privacy and protection efforts are deeply intertwined with the viability of the business and the ability to meet the needs and expectations of customers: particularly in the B2C space. So, it should go without saying that data privacy and data protection needs to be an ongoing, iterative, adaptable process rather than a project-based “checkbox” approach with a deadline. New regulations will always emerge; it is up to organizations to implement processes and technology that can support evolving needs rather than just the specifications of a single law.

Automation will be critical. There is no amount of human talent and effort sufficient to scale to the data management volume challenges within a typical modern organization. There is simply too much data to evaluate and protect. Capabilities such as automated detection of potentially-sensitive data sources, automated policy controls for data, automated control of data access rights, and automated fulfillment of data subject access requests (DSARs) are all possible and – increasingly – necessary.

The PrivacyOps concept and framework looks to operationalize data privacy practices across the organization, leveraging automation, so that not only compliance objectives can be met, but so that the friction of end user data access and leverage can be reduced. Better data management and data privacy controls, when implemented correctly, can actually free up data that was formerly locked away in silos. To the average business end user, such as a data analyst, an effective PrivacyOps program will be invisible and simply make access to appropriate data sources quicker and more seamless.

The PrivacyOps Framework

What does PrivacyOps look like? It is a framework, rather than a specific tool, that takes into account people, processes, and technology. Emphasis on automation of error-prone and high-scale tasks is a must. At its most rudimentary, it breaks down into the convergence of four basic “systems:”

  • System of engagement with those that have privacy rights
    How will the organization communicate securely and effectively, and acknowledge the shifting preferences, of its data subject and customer audience?
  • System of automation for fulfilling privacy requirements
    How will the organization automate the assessment of third-party risk, or delivery of data to those that request it, or appropriate and timely notifications in the case of a breach?
  • System of record, including privacy knowledge and analytics
    How will the organization actually demonstrate that its compliance initiatives have been consistent and robust, or learn from its past data privacy efforts?
  • System of collaboration among privacy stakeholders
    How will the organization enable diverse data-privacy stakeholders to communicate and collaborate effectively without exasperating personal data sprawl?

Success means a shift in perceptions and approach

It’s time to stop thinking of data privacy and data protection as a burden, a barrier, or a niche responsibility within the organization. Responsible use of data, and the data management practices that enable it, can benefit everyone: from those depending on high-quality information to those that depend on the trust of consumers to cultivate long-lasting, profitable relationships.

Yes, organizations will need to leverage automation and technology to achieve these objectives. But ultimately, the discussion needs to start with business stakeholders. Getting everyone in alignment should be the first step, and establishment of effective and adoptable processes should be next. Finally, appropriate technology tools should be considered, selected, and implemented.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox


Share

More Stories that May Interest You
Videos
View More
Mitigating OWASP Top 10 for LLM Applications 2025
Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...
View More
DSPM vs. CSPM – What’s the Difference?
While the cloud has offered the world immense growth opportunities, it has also introduced unprecedented challenges and risks. Solutions like Cloud Security Posture Management...
View More
Top 6 DSPM Use Cases
With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...
View More
Colorado Privacy Act (CPA)
What is the Colorado Privacy Act? The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal...
View More
Securiti for Copilot in SaaS
Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...
View More
Top 10 Considerations for Safely Using Unstructured Data with GenAI
A staggering 90% of an organization's data is unstructured. This data is rapidly being used to fuel GenAI applications like chatbots and AI search....
View More
Gencore AI: Building Safe, Enterprise-grade AI Systems in Minutes
As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...
View More
Navigating CPRA: Key Insights for Businesses
What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...
View More
Navigating the Shift: Transitioning to PCI DSS v4.0
What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards to ensure safe processing, storage, and...
View More
Securing Data+AI : Playbook for Trust, Risk, and Security Management (TRiSM)
AI's growing security risks have 48% of global CISOs alarmed. Join this keynote to learn about a practical playbook for enabling AI Trust, Risk,...

Spotlight Talks

Spotlight 11:29
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Watch Now View
Spotlight 11:18
Rewiring Real Estate Finance — How Walker & Dunlop Is Giving Its $135B Portfolio a Data-First Refresh
Watch Now View
Spotlight 13:38
Accelerating Miracles — How Sanofi is Embedding AI to Significantly Reduce Drug Development Timelines
Sanofi Thumbnail
Watch Now View
Spotlight 10:35
There’s Been a Material Shift in the Data Center of Gravity
Watch Now View
Spotlight 14:21
AI Governance Is Much More than Technology Risk Mitigation
AI Governance Is Much More than Technology Risk Mitigation
Watch Now View
Spotlight 12:!3
You Can’t Build Pipelines, Warehouses, or AI Platforms Without Business Knowledge
Watch Now View
Spotlight 47:42
Cybersecurity – Where Leaders are Buying, Building, and Partnering
Rehan Jalil
Watch Now View
Spotlight 27:29
Building Safe AI with Databricks and Gencore
Rehan Jalil
Watch Now View
Spotlight 46:02
Building Safe Enterprise AI: A Practical Roadmap
Watch Now View
Spotlight 13:32
Ensuring Solid Governance Is Like Squeezing Jello
Watch Now View
Latest
View More
Databricks AI Summit (DAIS) 2025 Wrap Up
5 New Developments in Databricks and How Securiti Customers Benefit Concerns over the risk of leaking sensitive data are currently the number one blocker...
Inside Echoleak View More
Inside Echoleak
How Indirect Prompt Injections Exploit the AI Layer and How to Secure Your Data What is Echoleak? Echoleak (CVE-2025-32711) is a vulnerability discovered in...
What is SSPM? (SaaS Security Posture Management) View More
What is SSPM? (SaaS Security Posture Management)
This blog covers all the important details related to SSPM, including why it matters, how it works, and how organizations can choose the best...
View More
“Scraping Almost Always Illegal”, Netherlands DPA Declares
Explore the Dutch Data Protection Authority's guidelines on web scraping, its legal complexities, privacy risks, and other relevant details important to your organization.
Beyond DLP: Guide to Modern Data Protection with DSPM View More
Beyond DLP: Guide to Modern Data Protection with DSPM
Learn why traditional data security tools fall short in the cloud and AI era. Learn how DSPM helps secure sensitive data and ensure compliance.
Mastering Cookie Consent: Global Compliance & Customer Trust View More
Mastering Cookie Consent: Global Compliance & Customer Trust
Discover how to master cookie consent with strategies for global compliance and building customer trust while aligning with key data privacy regulations.
Understanding Data Regulations in Australia’s Telecom Sector View More
Understanding Data Regulations in Australia’s Telecom Sector
Gain insights into the key data regulations in Australia’s telecommunication sector. Learn how Securiti helps ensure swift compliance.
Top 3 Key Predictions on GenAI's Transformational Impact in 2025 View More
Top 3 Key Predictions on GenAI’s Transformational Impact in 2025
Discover how a leading Chief Data Officer (CDO) breaks down top predictions for GenAI’s transformative impact on operations and innovation in 2025.
Gencore AI and Amazon Bedrock View More
Building Enterprise-Grade AI with Gencore AI and Amazon Bedrock
Learn how to build secure enterprise AI copilots with Amazon Bedrock models, protect AI interactions with LLM Firewalls, and apply OWASP Top 10 LLM...
DSPM Vendor Due Diligence View More
DSPM Vendor Due Diligence
DSPM’s Buyer Guide ebook is designed to help CISOs and their teams ask the right questions and consider the right capabilities when looking for...
What's
New