Privacy is a business imperative: enhancing your organisations reputation

For a balanced privacy risk programme, an organisation is required to analyse domains such as legal requirements, third-party management, data subject rights, etc. to identify where possible risks may lie. This basic requirement assists your organisation to anticipate the efforts required to identify risks and plan to remediate them efficiently starting with high risks which can cause the most harm. Identifying high, medium and low risks will help understand which standard is required as there are several standards such as the ISO 27001 and the NIST Risk Management Framework, among others. A standardised framework demonstrates an organisation’s effort taken to identify and control privacy risks. It is also a good practice to have audit mechanisms in place for identifying gaps and becoming aware of key issues. However, if your organisation has a mature privacy programme, a customised framework could also be implemented based on your organisation’s processes. Like most entities, which have now adopted AI for basic processes, the NIST AI Risk Management Framework is a good point to start.

It is pertinent to note that regulations form the basis for privacy requirements which varies in different geographies. For instance, although the GDPR applies to countries in the European Union, countries including Austria and Germany require organisations to have a double opt-in mechanism and hence create a new risk for organisations processing personal data from these countries. Hence, it is necessary to identify regulations which are applicable to your organisation and understand if there are any additional requirements or conflicts between these regulations. This process helps in minimising risks, if not mitigating them. Standing on the verge of enforcing the Digital Personal Data Protection Act, 2023, India has seen a drift in the last decade to becoming one of the largest consumer markets. Considering the heavy backlash in the Indian Parliament on 3 August 2023, India’s privacy law has come out stronger. Looking at the new amendments such as requirement of valid contracts with sub-processors, responsibility of data fiduciaries, enhanced data retention requirements and specified legitimate uses, India has come closer than ever to achieving transparency and protection of Indian citizen’s personal data. Moreover, keeping up with compliance across multiple regulations has been the most common and emerging privacy risk according to the Privacy Risk Study 2023.2

Using basic or privacy enhancing technologies can help organisations simplify processes such as data subject rights management, data mapping, consent management and incident response, to name a few. The Privacy Risk Study, 20232 shows that every company uses some level of technology in their internal processes as a part of their privacy risk management. Thirty per cent of these organisations use basic technologies such as spreadsheets. These technologies can also be integrated with your organisation’s enterprise risk management technologies and with automation, can reduce cost. Weaknesses or vulnerabilities in security technology also lead to a higher risk of breaches. The Verizon Data Breach Investigations Report also reports that 80 per cent of cybersecurity attacks are from external factors and 20 per cent of breaches were due to human error. Using technology can also curb unintended data breaches as many breaches occur due to human error.3 Living in a world where individuals and organisations are prone to cybersecurity attacks, it is a basic requirement to have controls in place to reduce the risk of cybersecurity attacks. Privacy enhancing technologies can aid in automating detective and preventive controls and can help mitigate risks or bring them to a level which is in line with your organisation’s risk appetite. It is also a good practice to structure a line of defence including response teams, reporting structures and oversight responsibilities based on the level of risk arising from incidents.

Privacy by Design helps go beyond compliance and strengthens your privacy framework. It includes aspects of risk, security and privacy, and enables organisations to demonstrate compliance to regulators as well. As a part of your risk management programme, it is also very crucial to identify roles and responsibilities of your employees and can help in identifying departments having higher risks and require more training. This design should also enable privacy departments to work with other functions such as product and engineering, marketing and human resources departments. This can help in improving your framework and planning your risk appetite. Involving your privacy department in the early stages of these processes to identify risks and prepare for any exposure arising from these risks can increase efficiency. The lack of implementing Privacy by Design is an internal risk and was identified as the third highest risk in the Privacy Risk Study 2023.2