July 11, 2018 By Shane Schick 2 min read

As local privacy regulations take effect in places like California and the U.K., security leaders around the world are sensing a shift toward stronger data privacy and transparency — and are using these laws as guidelines to help them make budgetary decisions.

The California Consumer Privacy Act was signed into law on June 28, 2018, and will take effect by 2020. The law will take an approach similar to the General Data Protection Regulation (GDPR) regarding transparency and consent around personal information. GDPR went into effect across the European Union (EU) just one month before the new law’s signing.

Like other privacy regulations, organizations in California must now ensure their customers know what kind of information they are collecting and sharing with third parties, such as advertisers and marketers. Consumers can choose to opt out of having their information collected, and companies that fail to comply risk incurring fines from the state’s attorney general.

Local Privacy Regulations Guide Private Sector Security Strategies

While GDPR and the California Consumer Privacy Act focus on how companies gather and manage data, other legislators are trying to ensure that the systems they use don’t fall prey to cybercriminals.

The U.K.’s Cabinet Office, for instance, published the first iteration of its “Minimum Cyber Security Standard” in June 2018. Though designed as a checklist for government agencies, organizations can adopt some of its practices in the private sector — such as checking websites and applications for common vulnerabilities — to keep ahead of further privacy legislation. As with more traditional privacy regulations, it outlines several mandatory requirements, including support for Transport Layer Security (TLS) encryption.

Regulatory Activity Impacts Security Budgets Around the World

These new laws and regulations reveal that chief information security officers (CISOs) from California to the U.K. are starting to use privacy regulations as a guide to determine what resources they will need to be effective.

For instance, according to a February 2018 report from consulting group Ankura, The Shifting Cybersecurity Landscape: How CISOs and Security Leaders Are Managing Evolving Global Risks to Safeguard Data, 73 percent of CISOs said regulatory activity drives their decision-making around security budgets — and all respondents said they had to comply with at least one such framework.

Even if privacy regulations like GDPR don’t directly pertain to their organizations, the Ankura report suggested that security leaders are paying close attention because they recognize that one piece of legislation can influence what other governments may demand in the future.

In other words: The effects of cybersecurity legislation in places like the E.U., the U.K. and California are reaching far past their own borders. As data privacy laws proliferate around the world, security leaders everywhere will be impacted by the shift toward greater protection and transparency.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today