Data Privacy: Guide to Definitions, Regulations, and Compliance

What is Data Privacy?

Data privacy refers to the identification and appropriate handling of sensitive data belonging to individuals or companies. This includes personally identifiable data, financial data, health information, sensitive business data, and intellectual property.

The objective of data privacy programs is to protect the confidentiality and integrity of data, avoid damage to an organization and its customers, and address the risk of compliance violations through data discovery and data security measures.

With the massive growth of the digital economy, many aspects of our personal and business lives are moving online. This means that organizations are collecting more personal data than ever, and this data is becoming more significant. This has given rise to data privacy laws in many parts of the world, most prominently the European Union (EU), which defines the rights of “data subjects” and regulates how companies should collect and secure personal data.

The tremendous importance of personal data for its owners, and the major risk of financial loss, reputational damage, and compliance violations if it is compromised mean that data privacy is a concern no business can afford to ignore.

Why is Data Privacy Important?

Privacy is considered a fundamental human right in many jurisdictions, and data protection laws have been enacted to protect this right. Data privacy is also important to individuals—before consumers do business with a company, they must have confidence that their personal data will be handled with care. Organizations use data privacy practices and technologies to demonstrate to customers that their personal data will be safe.

Individuals can face significant risks if their personal data is compromised or not appropriately controlled. Criminals can use personal data to perform fraud and steal from an individual. Businesses may sell personal data to advertisers or other external parties without a user’s consent, resulting in unsolicited marketing or advertising. Unwanted tracking and monitoring of an individual’s activities can limit their personal freedoms.

Perhaps most significantly, when personal data is compromised, it can be used to perform identity theft, which allows criminals to generate debt and perform criminal activity in a victim’s name.

For businesses, these consequences can cause irreparable damage to reputation and brand image, as well as fines, sanctions, and other legal consequences.

Data Protection vs. Data Security vs. Data Privacy

Data protection, data security, and data privacy are related and overlapping terms, but there are important differences between them.

Data Security vs. Data Privacy

There is a significant overlap between data privacy and data security. For example, access control systems help protect data privacy and can also be a data security tool.

The key difference between these terms:

• Data privacy focuses on ensuring that only authorized people have access to personal information.
• Data security is the protection of data against a range of malicious threats, including but not limited to breaches of privacy. For example, a ransomware attack can result in the loss of valuable data without violating its privacy. This type of attack can be prevented by data security practices and would be outside the scope of a data privacy program.

Data Privacy vs. Data Protection

Data privacy and data protection are related, but separate concepts:

• Data privacy focuses on ensuring that unauthorized parties cannot access private data.
• Data protection provides organizations with a way to recover data after a data loss event. For example, backup and disaster recovery systems are data protection mechanisms. Data protection systems need to take additional measures to protect data privacy—for example, by encrypting backups.

Data Protection vs. Data Security

To summarize the difference between data security and data protection:

• Data security is designed to prevent malicious attacks on an organization’s data and other IT resources.
• Data protection is designed to help recover data when needed. It can be considered the last line of defense, ensuring that data can be recovered even if data security measures fail and attackers manage to destroy or tamper with sensitive data.

Important Data Privacy Laws

There is no single law that monitors data privacy. Rather, there are multiple laws and frameworks that might apply to your organization depending on the type of data you collect, your business’s location, and the territories in which you do business.

Here are some of the most important data privacy laws in the world today:

• The General Data Protection Regulation (GDPR) – the GDPR legislation unifies data privacy laws in the European Union (EU). It protects EU citizens and any data describing them and ensures organizations collecting this data do so responsibly and safely. The GDPR strives to protect personal data against unlawful or unauthorized processing and accidental loss, damage, and destruction.
• The Family Educational Rights and Privacy Act (FERPA) – the FERPA US federal legislation protects students’ privacy. FERPA applies to personally identifiable information (PII) handled by all educational institutions receiving federal funds.
• Health Insurance Portability and Accountability Act (HIPAA)—a US federal law that defines how organizations store, protect, share, transmit, and audit protected health information (PHI). This primarily affects healthcare providers and hospitals but also applies to any other business that stores or processes patient information on behalf of healthcare organizations.
• California Consumer Privacy Act (CCPA)—the CCPA oversees how businesses process personal data belonging to California residents. It grants California residents the right to know how businesses collect their data, have access to the data, and be able to request its erasure.
• Children’s Online Privacy Protection Act (COPPA)—a US federal law that defines how companies collect and share information about children. Organizations processing the data of children under the age of 12 must protect screen names, email addresses, chat names, photos, audio files, and geolocation coordinates.
• Payment Card Industry Data Security Standard (PCI DSS)—retailers or organizations that store consumer finance and credit card data are required to comply with the PCI DSS standard. This compliance standard focuses on protecting payment information and preventing fraud and theft of personal information. Any organization that stores credit cardholder data is required to comply with PCI DSS requirements.
• The Australian Privacy Principles (APP) – the APP privacy framework applies to Australian government organizations, private sector organizations that generate an annual revenue exceeding $3 million, and organizations providing health services. It includes thirteen privacy principles that define standards, obligations, and rights, such as the disclosure, usage, and collection of personal data.

These are only a few examples of data privacy regulations—there are many more regulations and standards created by industry organizations or legislated at the country, state, or regional level.

Data Privacy Challenges and Solutions

Data Discovery

In many organizations, sensitive data is spread across on-premises systems, hosting providers, and cloud systems. Many organizations have legacy systems that make it difficult to track the long-term history of sensitive data.

The challenge is finding personal data, understanding its significance, and tracking it in a dynamic environment. In order to protect personal data, you must first know that it exists. Therefore, data privacy operations begin with inventory tracking of sensitive data across all organizational systems.

Successful data discovery requires an active inventory system that automatically tracks the location of sensitive data throughout its lifecycle, from inception to retirement. This involves two primary components:

• A discovery tool that scans data catalogs and repositories of structured and unstructured data to discover sensitive data, using direct and inferred matches.
• An inventory tool that creates an authoritative directory of data stores throughout the organization, the sensitive data they store, and its security and compliance requirements.

Data Design

At an architectural level, organizations need to consider the best way to enforce privacy principles on legacy systems and newly introduced systems:

• For legacy systems—data privacy processes must be integrated into the core system. This often requires retrofitting the system to meet new data privacy requirements. It is important to find the right balance between privacy requirements, ease of use, and existing business processes.
• For new systems—data privacy should be part of system design from day one. Data privacy concerns should be handled with efficient, automated processes rather than reactive and error-prone manual processes.

Building privacy into an organization’s systems is a major challenge but is the key to a sustainable, reliable data privacy program.

Reduce Personal Data Sprawl

Many organizations control a large volume of sensitive data, which is very difficult to manage. The problem is made worse by factors like:

• Large application portfolios
• Loose data practices that enable storage of non-essential private data
• Non-standard data modeling
• Outdated and inconsistent architectures
• Technical debts in business processes
• Data stored across on-premise systems, hosting providers, and public clouds

The challenge is to eliminate the unwanted generation of sensitive data and redesign applications to reduce the scope of sensitive data. Any system that does not require personal data for its essential functions should not process or store personal data.

Here are a few ways to reduce personal data sprawl:

• Avoid the use of personally identifiable information as an identifier in software systems.
• Eliminate the transfer of sensitive data throughout the architecture for convenience reasons.
• Identify systems and business processes that have changed and no longer require personal data.
• Centralize personal data to a well-protected centralized data management system rather than having personal data stored by multiple functional systems.

What Is Data Privacy Management?

Data privacy management enables organizations to protect sensitive data and remediate privacy breaches. Data privacy management tools assess the impact of technological change on privacy, align IT activities with privacy regulations, and track events that may lead to unauthorized disclosure of personal data.

Data privacy management software allows organizations to secure sensitive data in a large distributed environment, automating processes and policies to ensure scalability and efficiency. It also reduces human error when complying with regulations and standards.

This type of solution usually provides the following capabilities:

• Data discovery—identifying where private data resides. Data privacy management software scans networks, endpoints, applications, and cloud systems to identify structured and unstructured data.
• Data classification—automatically analyzing data patterns to identify personally identifiable information (PII) and determine the level of sensitivity for security and compliance purposes. This is also useful for reclassifying sensitive data in response to changes in compliance requirements.
• Compliance with data privacy laws—ensuring private data meets compliance requirements, providing auditability for compliance authorities, and identifying compliance risks.
• Remediation—providing remediation guidance for data privacy risks, helping teams prioritize privacy issues and resolve them before they lead to security issues or compliance violations.

Best Practices for Ensuring Data Privacy

The following best practices can help your organization protect data privacy more effectively in a modern data-rich environment.

Practice Minimal Data Collection

When collecting data, it is critical to collect only as much as you need. For example, if a business process does not require a user’s date of birth or full name, those details should not be collected. This also reduces bandwidth and storage costs.

Even when personal data needs to be collected, consider whether it needs to be stored. Use a “verify not store” approach. For example, you can use a third-party system to verify a user’s identity based on third-party data sources. Your systems could store only a record of successful identification without actually storing the user’s personally identifiable data.

Communicate with Customers and Users

Communicate with customers to show them you respect and protect their data. Whenever you collect a customer’s data, ask for their consent. Requests for consent should be built into any digital user interface that collects or uses customer data, and users should receive receipts documenting their consent. This is mandatory in many compliance regulations, including the GDPR.

Dynamically Enforce Policy Changes

Once the organization has identified sensitive data and defined its data privacy policy, the next step is to implement a data privacy solution to ensure the policy is enforced across the organization. Remember that defining a data privacy policy is an important first step, but it doesn’t guarantee the policy will actually be implemented. Data privacy policies are often considered a record management operation, but they go far beyond that. Organizations not only need to manage existing data. They also need to account for large amounts of data constantly being created and business processes that are in constant flux. This requires a holistic approach to data privacy that includes automated tools.

Implement Data Security Controls

To achieve compliance, you need to demonstrate your ability to identify sensitive data across the enterprise and have the appropriate security controls in place. Sensitive data should be encrypted, hashed, masked, or anonymized. You cannot rely on metadata because it might be incorrect or might misrepresent the true sensitivity of the data.

Data privacy solutions can automatically identify sensitive data and determine the required security measures. They should be combined with security controls appropriate for each level of data sensitivity—including access controls, encryption, monitoring, and auditing.

Related content: Read our guide to data masking (coming soon)

Data Privacy with PathLock

Pathlock Security Platform’s dynamic data masking capabilities provide fine-grained control over which sensitive data fields can be masked for any specified user in the context of any situation. Pathlock allows companies to:

• Centralize data masking enforcement throughout your ERP ecosystem with a single ruleset.
• Deploy dynamic policies that account for risk based on the context of access, such as location, IP address, time, data sensitivity, and more.
• Protect sensitive data in production and non-production environments.
• Align data masking controls with existing governance (corporate) policies.
• Mask sensitive PII based on the data subjects’ residency (country/nationality).
• Mask data fields in transactions (Tcodes) that are unnecessary for a role.

Get in touch with us for a demo and see for yourself how Pathlock can improve data security and reduce compliance risk with a fully dynamic data masking solution.