The importance of an integrated approach to data privacy regulations in cybersecurity
Expanding data privacy regulations spotlight the need for organizations to safeguard their data and ensure compliance. These regulations can take make many forms including new legislation implemented in multiple states, however they present similar operational challenges. In each area within the CISO’s organization, when an oversight or a breach occurs, a breach of personal data is often among the most consequential due to the costs of managing the breach along with the potential for financial penalties from regulators in addition to the significant risk of reputational harm. Accordingly, not only does achieving compliance and cybersecurity necessitate a comprehensive understanding of regulatory obligations, it also requires an integrated approach between privacy and security, as well as around how personal information is managed within the CISO’s organization.
Increasing regulatory pressure
Recent years have seen an upsurge in regulatory requirements surrounding data privacy, driven by new legislation setting higher standards. Since the enactment of the California Consumer Privacy Act in 2018, approximately 20 states have adopted comprehensive privacy laws.
Increased legislation and heightened enforcement have taken place in tandem with an expansion in the quantity and type of sensitive personal data generated through standard business operations. For instance, with the increase in remote and hybrid-work policy adoption, organizations increasingly use digital tools to intricately monitor and track employee performance. This new type of data is arguably more personal than manual performance evaluation documents, and exists in much larger volumes. Given the severe negative consequence to employee livelihoods from unauthorized disclosure of this data, heightened privacy safeguards with associated penalties have been established.
The message from regulatory bodies is clear: adopting robust privacy practices is essential for ensuring consumer trust and mitigating the risk of severe penalties.
Cohesion within the cybersecurity organization
To meet increasing regulatory demands, partnership between the cybersecurity, legal, privacy, compliance, and data functions must be well established and strong governance processes must be in place across these teams. Further, each team within the CISO’s organization – Governance Risk & Compliance, Third-Party Security, Identity & Access Management, etc. – needs to understand its unique role in helping the broader organization to achieve data privacy compliance and how its actions impact the broader objective.
For example, Application Security analysts must be prepared to assess how data is processed, stored, and transmitted within applications, as well as understanding the privacy implications of their findings. Third-Party Security professionals must be equipped to understand the privacy implications of the types of data being shared with vendors and incorporate privacy reviews as part of ongoing due diligence assessment procedures. Effective Identify & Access Management requires rigid adherence to the principle of least privilege, to ensure system and network access to sensitive data is solely provisioned on a need-to-know basis.
Cyber teams cannot operate in silos but rather must communicate and collaborate to ensure comprehensive data protection. This includes cyber stakeholders understanding and implementing the routine privacy-related aspects of their functions but also knowing when it is necessary to involve Privacy experts directly to obtain targeted guidance. Such integration must be prioritized to ensure that privacy considerations are baked into standard, day-to-day processes, rather than being an afterthought.
As achieving regulatory compliance requires the active participation of all cyber groups, it is crucial for the Privacy function to provide clear leadership. Key privacy definitions and requirements for data classification, data minimization, and data deletion, must be straightforwardly defined and centrally communicated by the Privacy function. Regular cross-functional meetings, shared objectives, and unified reporting mechanisms based on these foundational definitions across cybersecurity functions can then help to achieve shared awareness of data privacy responsibilities.
Broad organizational alignment
Business owners are often the custodians of critical data, including sensitive personal data, and are best positioned to provide the necessary information to ensure data privacy. It is therefore crucial for the cybersecurity function as a whole to make it as seamless as possible for the business owners to work with cyber teams in alignment with privacy requirements.
One of the major challenges in this interaction is avoiding redundant and unnecessary requests for information. Business owners are more likely to provide accurate and complete information when they understand the purpose behind the requests and when these requests are streamlined and non-repetitive. For instance, instead of the Application Security team, the Data Privacy team, and the Third-Party Security team each independently requesting data from a business unit, a coordinated effort should be made to consolidate these requests. A single, well-structured questionnaire or data requisition form can significantly enhance efficiency and accuracy in information gathering.
Moreover, the way that information is requested matters greatly. Clear and concise communication, with explanations of how the provided data will contribute to regulatory compliance, can foster a more cooperative environment. Training sessions and informative materials can also be provided to business owners to help them understand the importance of data privacy and their role in maintaining it.
Conclusion
By ensuring that all cybersecurity teams are aligned in their objectives and actions, and by presenting a unified front when engaging with business owners, organizations can more effectively transform regulatory challenges into actionable business decisions. This integrated approach streamlines the process of achieving compliance and also fosters a culture of collaboration and shared responsibility that is crucial for the holistic protection of data.
Subscribe to Risk and Cyber Insights
The latest news and updates on how organizations can manage risk in today's environment.
Insights on cyber security
KPMG professionals are passionate and objective about cyber security. We’re always thinking, sharing and debating. Because when it comes to cyber security, we’re in it together.
Meet our team
