Safety function: automating GDPR compliance gives you one less thing to worry about
Not being compliant when it comes to data protection could cost your business millions. But using software to automate GDPR compliance can save you time and money. Information Age runs through the best packages out there
The European Union’s General Data Protection Regulation (GDPR) is now well-established as a global standard for international companies to comply with when it comes to securing and managing their data, and their customers’ and partners’ data.
Non-compliance with GDPR in relation to any data breaches or leaks can also result in potentially big fines.
Here we look at the key types of GDPR compliance software available for chief technology officers and their colleagues.
GDPR compliance software challenges
Vicki Utting, managing executive of Vigilant Software, says of GDPR requirements: “GDPR compliance is a challenging and time-consuming activity. The expanding scope and impact of compliance requirements and audit programmes, plus the ambiguity and complexity of the GDPR law itself, creates a never-ending and exhausting to-do list for CTOs – but one that is vital for organizations to survive and thrive.”
Ian Wood, senior director and head of technology for the UK and Ireland at cloud data management vendor Veritas Technologies, adds: “Much of what is on the market today is limited to a small number of specific applications or environments, which will only ever scrape the surface when it comes to the challenges organizations face, leaving them open to falling foul of the regulation.”
The rapid expansion of cloud services and collaboration tools that businesses are now using as a result of the pandemic and accelerated digital transformation, says Wood, only serves to complicate the issues around GDPR.
“To match the constantly evolving landscape, organizations need to partner with a vendor that is able to span all of the platforms where data is being held. One of the biggest risk areas is the explosion of data sharing through cloud collaboration tools, which are replacing email as the preferred way of sending files.
“To miss any of these important cloud platforms out of the compliance process makes it impossible to meet the requirements of GDPR. Therefore, the ability to sweep all systems not only saves time but provides peace of mind that nothing will be missed.”
Darren Wray, head of Guardum data protect solutions at DFIN, says: “GDPR compliance and support software is currently in flux. The recent proposed changes to the UK GDPR have left some users reconsidering the solution they have chosen, having realized it isn’t as much of a time saver they originally thought.
“Of course, privacy compliance is not standing still and there are changes in different parts of the world that are also influencing companies to look the way they adhere to these regulations, and ensure they are protecting their data.”
Egnyte provides GDPR compliance by locating, controlling and securing the personally identifiable information (PII) of EU residents stored in on-premises or cloud repositories.
Kris Lahirt, chief security officer at Egnyte, says: “With 65 percent of the world’s population expected to have their personal data covered under privacy regulations by 2023, respecting data privacy has never been more critical. There is increasing content moving between on-premise and multi-cloud environments as organizations have shifted the way they store and access their unstructured data.
“Business users are clamoring for consumer-like, self-service models of accessing files anytime, anywhere. Picking a solution that acts as a source of truth for all data is key to ensuring GDPR compliance.”
He says organizations need to look for a solution that can locate all employee and customer private data wherever it resides and classify it, provide real-time alerts for when specific types of content are accessed or shared, and maintain a comprehensive audit trail of all file and user actions that help with full visibility into regulated and company-sensitive data.
By using an effective log analysis tool, it should be easy to monitor and analyze the log data within your network. A good tool will confirm that your devices are secure, while also storing event logs for compliance auditing. By creating periodic compliance audit reports, it’s also easier for IT personnel to assess security risks and ensure their organizations are GDPR-compliant.
Rajesh Ganesan, president of ManageEngine, says: “In the event of anomalous activity on the network, IT personnel should be notified immediately via an alert. Moreover, effective log analysis tools should support file integrity monitoring, which can act as a warning system for permission access issues.”
Data Loss Prevention
In addition to using an effective log analysis tool, it is prudent to employ a data loss prevention (DLP) solution. Such a solution detects and classifies data, defines rules for authorized usage and secure transmission, and protects sensitive data on managed endpoints. Companies that allow BYOD (bring-your-own-device) could use a data containerization utility, ensuring that all corporate data is kept separate from the operating systems of user-owned devices.
With a good DLP tool, IT personnel can designate trusted applications for data processing, while also monitoring the network for insider threat detection and sensitive data movement.
Policies and Cookies
The offering from Ketch helps formulate policies that apply specifically to your company’s entire data and information ecosystem. Its GDPR service promises to ensure compliance with every regulation, covering data users and data systems.
For instance, cookie compliance is not the same as general compliance with GDPR regulations.
“It’s your responsibility to ensure data collected and processed with cookies is compliant with all aspects of GDPR,” says Ketch.
Ketch helps companies eliminate the often manual approaches to data discovery and adding new regulations to the compliance list, in favor of an automated “set-it-and-forget-it” approach.
“Our software gives you a centralized solution for conducting data discovery across multiple systems, setting GDPR policies for your data, and pushing those policies out across all systems, devices and user experiences,” the firm says.
Permutive provides “privacy safe infrastructure” to help publishers and advertisers reach audiences “safely and securely”. It says the advertising industry doesn’t have a good reputation for its use of data. Its audience platform empowers publishers and advertisers to “responsibly activate” audiences without any third-party access to personal data.
It does this by recreating the “idea of cookies”, which have already been phased out by the Safari and Mozilla browsers, and with the Chrome browser soon to follow suit. Instead of sharing data, Permutive uses hash mails to match and map audience data without sharing it across advertisers and publishers, helping to enable GDPR compliance.
Michael O’Donnell, data ecosystem specialist at Quest Software points out databases are a GDPR “pain point”. He says: “Many organizations fail to realize that databases are a critical security risk. The main goal for many attackers is to gain access to databases to steal a large volume of sensitive information. Many attack techniques, such as SQL injection, are specially designed to compromise database systems, and older versions of widely used Oracle databases, for instance, are susceptible to these attacks.”
One of the ideas behind regulatory compliance is a single version of the truth. “But organizations may have hundreds or thousands of data sources, and to get all this under control and comply with regulations requires a significant re-engineering of the architecture of the data and applications in the business,” O’Donnell says.
It is therefore important to discover where sensitive data may be stored and identify sensitive or critical data to set strict policies around its access.
O’Donnell says IT operations can quickly discover which servers are running databases that contain personal/sensitive information, based on the information in the metadata repository and business glossary. They can automatically scan databases for stored vulnerable data based on data polling or metadata attributes. They then need to put in place encryption, masking or redaction processes to protect it.
The Privacy Compliance Hub was set-up by two ex-Google lawyers, in response to a lack of skilled data protection teams at organisations. It offers a free GDPR compliance health check.
Other players in GDPR compliance software
GDPR compliance software
|company||Cloud delivered?||On-premises use?||Aimed at SMEs or Enterprises?|
Source: Information Age
Clive Humby – data can predict nearly everything about running a business – Clive Humby, inventor of the Tesco Clubcard, on ways to stop feeling so overwhelmed by data, how to convince your CEO of its importance, and why data should look forward and not backwards
How businesses can prepare for the Data Protection and Digital Information Bill – With the Data Protection and Digital Information Bill currently being reviewed in Parliament, Netwrix vice president of research and development Michael Paye explains how businesses can amply prepare
Forget digital transformation: data transformation is what you need – Stefano Maifreni, founder of Eggcelerate, discusses why organizations must focus on data transformation to maximize long-term value