A constantly changing regulatory environment has become the “new normal” for data privacy, and 2020 is no exception. The California Consumer Privacy Act (CCPA) went into effect in January and introduced one of the most sweeping requirements the U.S. has seen at a state level. In addition, the global health crisis has seen concerns around new and emerging uses of personal data. As the complexity of regulations increases, so does the responsibility for organizations to manage personal data and ensure their security and privacy teams are aligned to respond to security incidents and potential privacy breaches.

Security and privacy experts from IBM, Eden Autism, Iron Mountain and American Cyber Security Management recently discussed the current regulatory environment and shared best practices on managing a privacy practice and being prepared to respond to privacy-related cybersecurity threats. Below is a summary of the key takeaways.

A Foundational Privacy Practice Helps Organizations Manage Change

In order to stay ahead of change and lessen its impact, panelists recommend that organizations develop a foundational privacy practice. Elements of having a strong privacy practice include having robust policies, processes and tools in place to help manage data privacy and breach notification requirements. Employees should be regularly communicated with about training or changes that may affect them. For example, when employees shifted to working remotely overnight due to the global health crisis, new protocols needed to be quickly implemented for handling printouts and hard copies that include personal data. Having processes and tools in place to identify and communicate these kinds of changes can help teams adapt quickly and ensure compliance.

As a result of the global health crisis, there are a wide range of emerging uses of personal and health data, such as contact-tracing apps, telemedicine and network thermometers, still being defined. Having the tools and processes to manage data collection, retention and disposal, as well as privacy breach requirements and notifications are necessary to keep abreast of the changes and continuously adapt. Panelists’ recommendations for building a foundational privacy practice include adopting technologies that scale, aligning security and privacy teams, and recognizing privacy as a strategic differentiator.

Align Security & Privacy Teams

To quote one of the panelists, “privacy is a team sport.” A strong, foundational privacy practice recognizes the importance of breaking down silos between security and privacy teams. These two teams often have varying perspectives: While security is concerned with securing the data, the privacy team is focused on understanding the type of data collected, how it is stored and when and how it should be removed. These different viewpoints are necessary for privacy breach preparation and response to be handled efficiently and in a timely manner. With more and more versions of regulations appearing all the time, panelists recommend aligning security and privacy teams to ensure collaboration and a coordinated response. Most importantly, teams should “reach across the aisle” and start collaborating now, in order to prepare, rather than doing it for the first time when trying to respond to a major privacy breach.

Adopt Technologies that Scale and Adapt with Your Needs

There is no shortage of point solutions to address very defined needs. However, panelists recommend taking a broad approach to technology so that organizations are investing in tools that solve multiple problems, rather than one, and provide a platform to proactively address future needs. For example, a panelist shared that a tool used to monitor Medicaid exclusion checking was later used for other use cases that required automated monitoring, such as policy sign-offs for privacy and security staff and automated tracking of training and license expirations. Panelists recommend taking a holistic approach in order to proactively scale and address future needs.

To help improve privacy breach response times, organizations are leveraging orchestration and automation capabilities to help provide a platform for consistent, repeatable processes for privacy and security teams. By leveraging automation to assist in responding to Data Subject Access Requests (DSARs), companies can better coordinate their response, collaborate across teams and automate portions of the process, resulting in accelerated response times. Utilizing an automated solution, such as a Security Orchestration, Automation and Response solution, also provides a system of record and audit trail.

Recognize Privacy as a Strategic Priority

Executive support and leadership for privacy is one of the most important factors needed to ensure a robust privacy practice. An executive-driven approach sets the tone that permeates throughout the organization, encouraging collaboration across departments and providing privacy the attention it requires. HR, legal, compliance, security and IT are just some of the teams affected by privacy and need to have a “seat at the table.” Setting up a governance, risk and compliance (GRC) committee with cross-functional representation is suggested as a best practice to ensure privacy is visible and departments are held accountable. Conducting an assessment each year can help identify your privacy program’s strengths and weaknesses and highlights gaps and areas of improvement.

Taking a strategic approach to privacy with executive leadership and oversight in place will not only help companies mature their privacy posture, but provide opportunities to utilize privacy as a competitive differentiator.

To learn more about best practices for adapting to the current regulatory environment and hear directly from panelists, you can listen to a replay of the webinar here.

More from Data Protection

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Defensive Driving: The Need for EV Cybersecurity Roadmaps

As the U.S. looks to bolster electric vehicle (EV) adoption, a new challenge is on the horizon: cybersecurity. Given the interconnected nature of these vehicles and their reliance on local power grids, they’re not just an alternative option for getting from Point A to Point B. They also offer a new path for network compromise that could put drivers, companies and infrastructure at risk. To help address this issue, the Office of the National Cyber Director (ONCD) recently hosted a…

Why Quantum Computing Capabilities Are Creating Security Vulnerabilities Today

Quantum computing capabilities are already impacting your organization. While data encryption and operational disruption have long troubled Chief Information Security Officers (CISOs), the threat posed by emerging quantum computing capabilities is far more profound and immediate. Indeed, quantum computing poses an existential risk to the classical encryption protocols that enable virtually all digital transactions. Over the next several years, widespread data encryption mechanisms, such as public-key cryptography (PKC), could become vulnerable. Any classically encrypted communication could be wiretapped and is…

How the CCPA is Shaping Other State’s Data Privacy

Privacy laws are nothing new when it comes to modern-day business. However, since the global digitization of data and the sharing economy took off, companies have struggled to keep up with an ever-changing legal landscape while still fulfilling their obligations to protect user data. The challenge is that there is no one-size-fits-all solution regarding data privacy's legal requirements. Depending on the location and jurisdiction, data privacy laws can vary significantly in terms of scope and enforcement. But while the laws…