{"id":90509,"date":"2020-01-28T09:00:00","date_gmt":"2020-01-28T17:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=90509"},"modified":"2023-05-15T23:00:19","modified_gmt":"2023-05-16T06:00:19","slug":"data-privacy-compliance-being-good-world-citizen","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/28\/data-privacy-compliance-being-good-world-citizen\/","title":{"rendered":"Data privacy is about more than compliance\u2014it\u2019s about being a good world citizen"},"content":{"rendered":"
Happy Data Privacy Day! Begun in 2007 in the European Union (E.U.) and adopted by the U.S. in 2008, Data Privacy Day is an international effort to encourage better protection of data and respect for privacy. It\u2019s a timely topic given the recent enactment of the California Consumer Privacy Act (CCPA). Citizens and governments have grown concerned about the amount of information that organizations collect, what they are doing with the data, and ever-increasing security breaches. And frankly, they\u2019re right. It\u2019s time to improve how organizations manage data and protect privacy.<\/p>\n
Let\u2019s look at some concrete steps you can take to begin that process in your organization. But first, a little context.<\/p>\n
Since Data Privacy Day commenced in 2007, the amount of data we collect has increased exponentially. In fact we generate \u201c2.5 quintillion bytes of data per day!\u201d<\/a> Unfortunately, we\u2019ve also seen a comparable increase in security incidents. There were 5,183 breaches reported in the first nine months of 2019<\/a>, exposing a total of 7.9 billion records. According to the RiskBased Data Breach QuickView Report 2019 Q3<\/a>, \u201cCompared to the 2018 Q3 report, the total number of breaches was up 33.3 percent and the total number of records exposed more than doubled, up 112 percent.\u201d<\/p>\n In response to these numbers, governments across the globe have passed or are debating privacy regulations. A few of the key milestones:<\/p>\n Last year, GDPR levied 27 fines for a total of \u20ac 428,545,407<\/a> (over $472 million USD). California will also levy fines for violations of CCPA. Compliance is clearly important if your business resides in a region or employs persons in regions protected by privacy regulation. But protecting privacy is also the right thing to do. Companies who stand on the side of protecting the consumer\u2019s data can differentiate themselves and earn customer loyalty.<\/p>\n Before you get started, recognize that improving how your organization manages personal data, means building a culture that respects privacy. Break down siloes and engage people across the company. Legal, Marketing, SecOps, IT, Senior Managers, Human Resources, and others all play a part in protecting data.<\/p>\n Embrace the concept that privacy is a fundamental<\/strong> human right<\/strong>\u2014Privacy is recognized as a human right in the U.N. Declaration of Human Rights and the International Covenant on Civil and Political Rights<\/a>, among other treaties. It\u2019s also built into the constitutions and governing documents of many countries. As you prepare your organization to comply with new privacy regulations, let this truth guide your program.<\/p>\n Understand the data you collect, where it is stored, how it is used, and how it is protected<\/strong>\u2014This is vital if you\u2019re affected by CCPA or GDPR, which require that you disclose to users what data you are collecting and how you are using it. You\u2019re also required to provide data or remove it upon customer request. And I\u2019m not just talking about the data that customers submit through a form. If you\u2019re using a tool to track and collect online user behavior that also counts.<\/p>\n This process may uncover unused data. If so, revise your data collection policies to improve the quality of your data.<\/p>\n Determine which regulations apply to your business<\/strong>\u2014Companies within the E.U. that do business with customers within the E.U., or employ E.U. citizens, are subject to GDPR. CPPA applies to companies doing business within California and meet one of the following requirements:<\/p>\n Beyond California and the E.U., India is debating a privacy law<\/a>, and Brazil\u2019s regulations<\/a>, Lei Geral de Prote\u00e7\u00e3o de Dados (LGPD), will go into effect in August 2020. There are also several privacy laws in Asia<\/a> that may be relevant.<\/p>\n Hire, train, and connect people across your organization<\/strong>\u2014To comply with privacy regulations, you\u2019ll need processes and people in place to address these two requirements:<\/p>\n The GDPR requires that all companies hire a Data Protection Officer to ensure compliance with the law. But to create an organization that respects privacy, go beyond compliance. New projects and initiatives should be designed with privacy in mind from the ground up. Marketing will need to include privacy in campaigns, SecOps and IT will need to ensure proper security is in place to protect data that is collected. Build a cross-discipline team with privacy responsibilities, and institute regular training, so that your employees understand how important it is.<\/p>\n Be transparent about your data collection policies<\/strong>\u2014Data regulations require that you make clear your data collection policies and provide users a way to opt out (CCPA) or opt in (GDPR). Your privacy page should let users know why the data collection benefits them, how you will use their data, and to whom you sell it. If they sell personal information, California businesses will need to include a \u201cDo not sell my personal information\u201d call to action on the homepage.<\/p>\n A transparent privacy policy creates an opportunity for you to build trust with your customers. Prove that you support privacy as a human right and communicate your objectives in a clear and understandable way. Done well, this approach can differentiate you from your competitors.<\/p>\n Extend security risk management practices to your supply chain<\/strong>\u2014Both the CCPA and the GDPR require that organizations put practices in place to protect customer data from malicious actors. You also must report breaches in a timely manner. If you\u2019re found in noncompliance, large fees can be levied.<\/p>\n As you implement tools and processes to protect your data, recognize that your supply chain also poses a risk<\/a>. Hackers attack software updates, software frameworks, libraries, and firmware as a means of infiltrating otherwise vigilant organizations. As you strengthen your security posture to better protect customer data, be sure to understand your entire hardware and software supply chain. Refer to the National Institute of Standards and Technology for best practices<\/a>. Microsoft guidelines for reducing your risk from open source<\/a> may also be helpful.<\/p>\n Microsoft offers several tools and services to help you comply with regional and country level data privacy regulation<\/a>s, including CCPA<\/a> and GDPR<\/a>. Bookmark the\u00a0Security blog<\/a> and the Compliance and security series<\/a> to keep up with our expert coverage on security matters. Also, follow us at\u00a0@MSFTSecurity<\/a>\u00a0for the latest news and updates on cybersecurity and connect with me on LinkedIn<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Data Privacy Day is a great time to assess your company privacy policies to ensure you comply with local and regional regulations.<\/p>\n","protected":false},"author":96,"featured_media":90520,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3662],"topic":[3668,3669,3680],"products":[],"threat-intelligence":[],"tags":[3822],"coauthors":[2229],"class_list":["post-90509","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-news","topic-compliance","topic-data-protection","topic-privacy","tag-microsoft-security-insights"],"yoast_head":"\n\n
Don\u2019t build a data privacy program<\/em>, build a data privacy culture<\/em><\/h3>\n
\n
\n
Microsoft can help<\/h3>\n