What is Data Protection?

Before you can effectively protect your data, you must know what you have and where it is stored. Create a Data Asset Log to track the data points you collect. Include information about the reason for collection/need the data meets, whether you obtain consent to store it, where it is stored, and how it moves. 

During this process, it is also a good idea to scrutinize your reasons for collecting each data point. As you set up your protection system, you will see more data means increased risk and more cost. If you find you are collecting data that your organization doesn’t use, or uses immediately and then never again, then stop storing it so you can reduce your costs and risk.

Privacy laws and regulations generally require limiting data collection to data that is necessary for current business. Following this practice will keep your organization in compliance, reduce your data protection costs, and also reduce your likelihood of becoming a target. 

Using a Data Classification System is an organized way to ensure that each type of information you collect is appropriately protected. During this process, consider why someone might want your data and separate it into specific protection categories based on its sensitivity, value and potential usefulness. Each organization must determine the appropriate categories for their data. Some organizations only need two categories – public and confidential; others may need more levels of restriction, such as internal only, restricted and secret. This process allows you to separate valuable data that may be targeted from less important information. Classification categories are also useful for people using the data, by informing them of its sensitivity and need for protection.

Documenting and disseminating official policies is the best way to ensure that all employees follow the same procedures when working with organizational data. Drafting and maintaining procedures for data collection, storage, transfer and deletion also means you will have the information required to be in compliance with many privacy laws and regulations. Including security policies about topics like access, encryption, and sharing also set a standard to help employees know what data handling procedures are required.

Knowing what you have and where you have it is a basic requirement of data protection; but if all the information or plans are stored in someone’s head, it is impossible for anyone else to use. Documentation is critical for policy dissemination, and tracking adherence to policies and procedures. The documents should also be used as the basis of your incident response plan and actions if your organization faces a security breach. For small and medium-sized businesses, where responsibilities are often designated to only one person, documenting information is especially important as a safeguard against employee unavailability or loss during an incident.

Even some of the world’s top security systems have been the target of breaches, so no matter how strong your system is, everyone is at risk. Crafting and practice using a reliable response strategy is the best way to mitigate your risk. Begin by practicing redundancy – regularly create multiple backup copies of your data, preferably with one stored off-site. Follow this with documenting processes and procedures for regular system inspections and an escalation procedure to follow if anything unusual is found. Include a reporting procedure for non-IT employees to follow if they notice anything suspicious. And finally, be sure to include a regular process for testing – particularly allow your IT staff time to practice installing back up data, so that if the need ever arises, the process will go smoothly.

Human error is the greatest risk to data security. To protect your organization, all employees should be trained in your organization’s specific data protection techniques, as well as general cybersecurity awareness. Data privacy training and data protection training topics should include:

• Data handling processes and procedures
• Background and requirements of internal security policies
• Recognizing and resisting social engineering/phishing
• Using secure passwords and multi-factor authentication (MFA)
• Keeping devices safe, particularly when out of the office
• Incident response

Implement strong anti-virus, anti-malware and firewall systems and install them on all devices that access your network, including smartphones, tablets and even IoT (Internet of Things) devices. Look for tools that are designed to detect problems at endpoints and block them from network access if anything suspicious is found.

Finalizing this process does not mean data protection is “done.” The data an organization holds is constantly changing as business transpires. The only way to maintain security is to review your system regularly, at least annually, and repeat the process any time you add or remove data points.