A constantly changing regulatory environment has become the “new normal” for data privacy, and 2020 is no exception. The California Consumer Privacy Act (CCPA) went into effect in January and introduced one of the most sweeping requirements the U.S. has seen at a state level. In addition, the global health crisis has seen concerns around new and emerging uses of personal data. As the complexity of regulations increases, so does the responsibility for organizations to manage personal data and ensure their security and privacy teams are aligned to respond to security incidents and potential privacy breaches.

Security and privacy experts from IBM, Eden Autism, Iron Mountain and American Cyber Security Management recently discussed the current regulatory environment and shared best practices on managing a privacy practice and being prepared to respond to privacy-related cybersecurity threats. Below is a summary of the key takeaways.

A Foundational Privacy Practice Helps Organizations Manage Change

In order to stay ahead of change and lessen its impact, panelists recommend that organizations develop a foundational privacy practice. Elements of having a strong privacy practice include having robust policies, processes and tools in place to help manage data privacy and breach notification requirements. Employees should be regularly communicated with about training or changes that may affect them. For example, when employees shifted to working remotely overnight due to the global health crisis, new protocols needed to be quickly implemented for handling printouts and hard copies that include personal data. Having processes and tools in place to identify and communicate these kinds of changes can help teams adapt quickly and ensure compliance.

As a result of the global health crisis, there are a wide range of emerging uses of personal and health data, such as contact-tracing apps, telemedicine and network thermometers, still being defined. Having the tools and processes to manage data collection, retention and disposal, as well as privacy breach requirements and notifications are necessary to keep abreast of the changes and continuously adapt. Panelists’ recommendations for building a foundational privacy practice include adopting technologies that scale, aligning security and privacy teams, and recognizing privacy as a strategic differentiator.

Align Security & Privacy Teams

To quote one of the panelists, “privacy is a team sport.” A strong, foundational privacy practice recognizes the importance of breaking down silos between security and privacy teams. These two teams often have varying perspectives: While security is concerned with securing the data, the privacy team is focused on understanding the type of data collected, how it is stored and when and how it should be removed. These different viewpoints are necessary for privacy breach preparation and response to be handled efficiently and in a timely manner. With more and more versions of regulations appearing all the time, panelists recommend aligning security and privacy teams to ensure collaboration and a coordinated response. Most importantly, teams should “reach across the aisle” and start collaborating now, in order to prepare, rather than doing it for the first time when trying to respond to a major privacy breach.

Adopt Technologies that Scale and Adapt with Your Needs

There is no shortage of point solutions to address very defined needs. However, panelists recommend taking a broad approach to technology so that organizations are investing in tools that solve multiple problems, rather than one, and provide a platform to proactively address future needs. For example, a panelist shared that a tool used to monitor Medicaid exclusion checking was later used for other use cases that required automated monitoring, such as policy sign-offs for privacy and security staff and automated tracking of training and license expirations. Panelists recommend taking a holistic approach in order to proactively scale and address future needs.

To help improve privacy breach response times, organizations are leveraging orchestration and automation capabilities to help provide a platform for consistent, repeatable processes for privacy and security teams. By leveraging automation to assist in responding to Data Subject Access Requests (DSARs), companies can better coordinate their response, collaborate across teams and automate portions of the process, resulting in accelerated response times. Utilizing an automated solution, such as a Security Orchestration, Automation and Response solution, also provides a system of record and audit trail.

Recognize Privacy as a Strategic Priority

Executive support and leadership for privacy is one of the most important factors needed to ensure a robust privacy practice. An executive-driven approach sets the tone that permeates throughout the organization, encouraging collaboration across departments and providing privacy the attention it requires. HR, legal, compliance, security and IT are just some of the teams affected by privacy and need to have a “seat at the table.” Setting up a governance, risk and compliance (GRC) committee with cross-functional representation is suggested as a best practice to ensure privacy is visible and departments are held accountable. Conducting an assessment each year can help identify your privacy program’s strengths and weaknesses and highlights gaps and areas of improvement.

Taking a strategic approach to privacy with executive leadership and oversight in place will not only help companies mature their privacy posture, but provide opportunities to utilize privacy as a competitive differentiator.

To learn more about best practices for adapting to the current regulatory environment and hear directly from panelists, you can listen to a replay of the webinar here.

More from Data Protection

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

SpyAgent malware targets crypto wallets by stealing screenshots

4 min read - A new Android malware strain known as SpyAgent is making the rounds — and stealing screenshots as it goes. Using optical character recognition (OCR) technology, the malware is after cryptocurrency recovery phrases often stored in screenshots on user devices.Here's how to dodge the bullet.Attackers shooting their (screen) shotAttacks start — as always — with phishing efforts. Users receive text messages prompting them to download seemingly legitimate apps. If they take the bait and install the app, the SpyAgent malware gets…

Exploring DORA: How to manage ICT incidents and minimize cyber threat risks

3 min read - As cybersecurity breaches continue to rise globally, institutions handling sensitive information are particularly vulnerable. In 2024, the average cost of a data breach in the financial sector reached $6.08 million, making it the second hardest hit after healthcare, according to IBM's 2024 Cost of a Data Breach report. This underscores the need for robust IT security regulations in critical sectors.More than just a defensive measure, compliance with security regulations helps organizations reduce risk, strengthen operational resilience and enhance customer trust.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today