In recent years, more companies have realized the importance of data privacy, and roles related to data protection have evolved from part-time gigs into full-time jobs. Though everyone organization-wide should prioritize data privacy, the responsibility of developing and maintaining a privacy program falls on your privacy lead and the rest of your privacy team. Osano’s Rachael Ormiston talks about what the smartest organizations have in common: They’ve implemented a strong and structured data privacy program that’s agile enough to evolve within the ever-changing data privacy landscape.
An organization’s privacy goals should revolve around protecting personal data. In some places, such as the EU and California (and a growing number of other U.S. states), legislation cements this goal as law; however, even if your region hasn’t passed data privacy legislation, you should still take every measure to protect customer data.
Data privacy isn’t just the compliant thing to do, it’s also popular — 85% of adults worldwide want to do more to protect their online privacy. In an increasingly digital-first world, people’s awareness of the risks of sharing personal data online has increased, and with awareness comes concern. Two-thirds of surveyed adults from around the world think tech companies have too much control over their data. And they’re not wrong to be worried. 2022 had the second-highest number of data breaches on record (1,802), impacting more than 422 million victims. The average data breach cost over $4.3 million in 2022. Implementing robust privacy policies protects your customers, reputation and bottom line.
Good privacy practices benefit your organization in other ways, too. According to a Cisco survey, over half of the respondents reported $1 million or more in benefits from investing in data privacy over the last year, including:
- Fewer data breaches
- Reduced reputational damage
- Avoidance of noncompliance fines
- Increased customer confidence
Robust data privacy can help keep your organization’s reputation untarnished and your online reviews positive. If 60% of consumers say negative reviews deter them from using an organization’s services, safeguarding data and remaining compliant can help garner good online reviews. Good reviews can also drive new customer acquisition, as 85% of consumers trust online reviews as much as personal recommendations.
Honey, I Shrunk the Data: How to Keep Customer Info on a Need-to-Know Basis
It may be tempting to hoard the data you have gathered on your customers, but an increasing number of regulations and laws require businesses to do just the opposite. Sarah Hutchins and Robert Botkin from Parker Poe are here to tell you why that’s good news.
Read moreHow to build a privacy program
If you’re starting from scratch, implementing a privacy program may seem intimidating. Use these basic steps to guide your strategy development.
Identify what drives your privacy program
Do you want to build trust with your customers or avoid a data breach? Being compliant with applicable laws is another critical driver. Organizations must understand what rules and regulations apply to them based on their location and number of customers. Research these drivers and consider their effects on your privacy program.
Construct a formal strategy
Even if you don’t have all the answers at this stage, the success of your program depends on determining the direction of your program, especially since organizations with robust data privacy practices are about half as likely to experience a data breach as those without.
Use your formal strategy to attract buy-in
When everyone organization-wide understands and accepts the importance of implementing a privacy program, you’ll improve the likelihood of success. In fact, organizations with full support of privacy and security initiatives increase that success by up to 39% versus organizations with weak support. By getting buy-in, and conveying those drivers (Step 1), you can find ways to embed privacy into organizational strategies.
Find and consolidate disparate data
Unearth all your data spread across your organization or stored in different silos. Conduct a record of processing activities (RoPA) to classify and record pertinent information.
Execute a privacy risk assessment
These assessments determine your vulnerable areas and establish fixes for the weak spots. When assessing, take a hard look at your third-party vendors and their privacy policies to ensure their standards meet your criteria.
Define your goals and execution plan to identify next steps
Since you’ll have multiple goals, prioritize them based on your organization’s gaps and any applicable laws. Take time now to create or update your privacy policy to reflect your organization’s big-picture data processing procedure.
Utilize technology to support policy
Implement and utilize technical and organizational measures to protect personal data, including:
- Encryption
- Access controls
- Consent management
- Vendor onboarding processes
- Incident response plans
- Training the workforce in privacy and cyber awareness
Measure and monitor
Calculate your success by measuring and monitoring value-affirming data privacy metrics like:
- Vendor onboarding time
- Number of privacy rights exercised and response time SLAs
- How many risk assessments conducted
- How many audits performed
- Vendor review status and score
- Influence on projects
- Influence on deals
Maintain and manage your program
As data privacy regulations and your organization evolve, your program must, too. New data processes may require evaluations like a data protection impact assessment (DPIA). This risk assessment audit helps organizations identify, analyze and minimize privacy risks associated with collecting, processing, using, storing and sharing user data necessary to comply with many privacy regulations like the GDPR and CCPA.
Mind the gaps
Once your data privacy program launches, there are some suggested next steps to keep it optimized. Here’s how to tighten some common gaps:
- Data mapping: Prioritize data mapping to ensure you keep accurate records of your systems. Know who has access to the data and its storage location.
- Device management: Secure devices via data encryption, anti-malware software and strong passwords.
- Application development: Implement secure procedures for personal data starting in the development stage.
- Breach notifications: Create protocols for handling breaches.
- Privacy policies: Craft clear and accessible policies for all individuals sharing their data with you. Your team should regularly review these policies to ensure they meet regulatory requirements.
- Security testing: Annually test your systems’ vulnerabilities and potential penetration points to determine the level of data security. Run these tests whenever a major organizational change occurs, too.
- Employee training: Hold (at least) yearly employee training sessions to share updates about privacy laws and refresh the privacy procedures they must follow.
- Documentation: Champion accountability by implementing a process documenting each time someone handles an individual’s data.
- Continuous monitoring: Leverage continuous monitoring for instant alerts about any risks or gaps in your processes requiring your attention.
- Personal information retention and destruction: Implement policies specifying the storage and disposal of personal information.
Consider using a privacy maturity model to measure your level of success with each tenet of your privacy solutions. A privacy maturity model is a framework that helps organizations evaluate their status in specific areas of their privacy solutions, usually on a scale of 1 (immature) to 5 (optimized). A privacy maturity model offers a guide for ensuring an organization’s active, continuous compliance.
To grow in the continuously-evolving privacy environment requires companies to remain agile and honest about their privacy policies. Companies can maximize their data privacy potential by developing a robust and resilient privacy program that includes a privacy maturity model to continuously identify and remedy privacy gaps.
Rachael Ormiston is the head of privacy at Osano. With more than 15 years of professional experience, she has deep domain expertise in global privacy, cybersecurity, and crisis and incident response. Rachael is an IAPP FIP and has previously served on the IAPP CIPM exam development board. She has a personal interest in privacy risk issues associated with emerging technologies.
