Creating a Personal Data Management Exit Strategy

Email     |     Share  
1 | 2 | 3 | 4 | 5 | 6 | 7
Next Creating a Personal Data Management Exit Strategy-2 Next

The first step should be to create a policy that draws a clear line between data that relates to human beings and data that does not. The former category includes contact information and health and financial information, as well as an Internet Protocol address, geolocation data and other traces an individual leaves in the online world. The latter category especially includes business plans, corporate financial data and intellectual property. Separating the two is necessary, because different laws apply.

The true challenge resides in handling data that can fall into both categories. Whether an organization decides for or against declaring certain types of data as "personal data" depends on the organization's risk appetite. In most cases, companies tend to prefer to risk a little rebuke from a regulator rather than having to re-engineer complete business processes.

Organizations should create a privacy program that keeps personal data at arm's length, but under control, according to Gartner, Inc. Gartner predicts that by 2019, 90 percent of organizations will have personal data on IT systems that they don't own or control.

Enterprises have traditionally been the target of security threats, and until recently, those hackers focused on attacking vulnerable IT infrastructure. As protection for such infrastructure improves, the attackers' attention shifts to softer targets, such as employees, contract workers, customers, citizens and patients.

"As the amount of personal information increases multifold, individuals and their personal data will increasingly become a security target. And, yet in most scenarios the organization is still ultimately accountable for the personal data on its IT systems," said Carsten Casper, research vice president at Gartner. "The time has come to create an exit strategy for the management of personal data. Strategic planning leaders will want to move away from storing and processing personal data in the next five years."

"The PCI Data Security Standard (DSS) requires the implementation of stringent controls of those who collect and store credit card data. In response, many companies have decided to eliminate credit card data from their own systems and completely entrust it to an external service provider," said Mr. Casper. "The same could happen with personal data. If control requirements are too strong and implementation is too costly, it would make sense to hand over personal data to a specialized 'personal-data processor.'"

Gartner has identified the following steps to prepare for such a strategy.


Related Topics : Unisys, Stimulus Package, Security Breaches, Symantec, Electronic Surveillance

More Slideshows

infra100-190x128 Top 10 Strategic Technology Trends for 2017

Here are the top 10 strategic technology trends that will impact most organizations in 2017. Strategic technology trends are defined as those with substantial disruptive potential or those reaching the tipping point over the next five years. ...  More >>

Compliance4-190x128 GRC Programs: Building the Business Case for Value

Experience shows that organizations that manage GRC as an integrated program — involving people, processes and technologies — are more successful in delivering value to their organizations ...  More >>

Social14-190x128.jpg 10 Ways to Improve Your Social Media Security Policy and Posture

When phone calls, video conference information, pictures, chat logs, etc. are all stored in a central location via social media, a potential hacker has access to just about everything, quickly and easily. ...  More >>

Subscribe to our Newsletters

Sign up now and get the best business technology insights direct to your inbox.