Central control over sensitive data

Issue 5 2021 Security Services & Risk Management

Just as the European Union’s (EU) General Data Protection Regulation (GDPR) has had a huge impact on EU businesses and the multinational organisations handling their data, the Protection of Personal Information Act (PoPIA) in South Africa is set to have a similar effect.

The EU enacted its privacy legislation five years ago, however, today there is a growing list of companies large and small which have been fined. After a number of years in the legislative process, PoPIA has now been enacted in law and judging by the stance of the regulator in the run-up to full enactment, there may be some unpleasant surprises ahead for those companies who have taken a wait-and-see approach.


Chris Visagie.

GDPR has much to teach us in terms of mandates and the underlying principles of regulatory law. It is all about compliance and defining the consequences of not getting those regulatory ducks in a row, and delivers a fundamental change in how data controllers and data processors handle personal data.

Data has become a critical commodity, with organisations generating vast amounts of it. With the enforcement of PoPIA companies need to ensure that data is protected, however, firstly they need to know where the data is located and what the data contains before they can protect it. They also would need to understand the lifecycle and usage of data to be able to ensure the correct controls are applied.

If companies are to achieve PoPIA compliance, they will need to develop a strong understanding of their structured and unstructured data – doing this will enable them to drive transparency and consent. This also puts businesses in a position to minimise the data being kept including providing the capability to dispose of or rectify data – this can also assist with decreasing organisational risk.

The final part of the picture is the immensely important issue of security – if breaches are to be prevented, access control and data protection techniques need to be applied to ensure data protection.

Technology, the principal problem

PwC defines the role of technology as the principal factor in achieving GDPR compliance. They provide a set of recommendations which can equally be applied to PoPIA, such as the interpretation of requirements, mapping the technologies in play and quickly identifying the correct information that needs to be managed and protected.

Information insight is the key to solving these challenges of large volumes of data and high levels of complexity. The risks are high, lost customer confidence, security breaches, fines, sanctions and potential lawsuits. Organisations failing to translate compliance requirements into their technology stack run the risk of operational failure, which can, in turn, lead to reputational and legal damage.

Businesses need to learn how technology plays a key role in an organisation’s journey towards compliance. Instead of an ‘add-on’ or afterthought within business operations, protections for personal data need to be woven into the very fabric of data processing systems, meaning that entities must re-examine how they approach the use of technology in their organisations.

As such, it is obvious that, as well as being the problem, technology must provide the solution. If entities are storing too much personal data, for example, technology needs to deliver delete, erase, de-duplication and minimisation functionality.

The privacy challenges of data-driven businesses

Today’s data-driven businesses rely on analytics insights for creating customer value, maximising operational efficiencies and achieving competitive edge. More data than ever before is capturedand flows throughout enterprises from millions of IoT smart devices at the edge of the network, through thousands of applications, to repositories on-premises and on public and private cloud.

The issue is that among the terabytes of data captured by enterprises, there is highly sensitive information that if breached, could prove to be seriously damaging to a business. Breaches lead to loss of revenue and a decline in brand loyalty.

The challenge is that as data moves across modern IT in ever growing volumes. Security and privacy controls lacking co-ordination between silos and with no central policy management become ineffective. Businesses often don’t know what the sensitive data is that they are holding, nor where it’s located, where it flows or who is using it. If this sounds familiar it’s because you also have no central control over data privacy policy management and governance in your company. Privacy legislation strives to make data privacy requirements stricter by increasing penalties for data breaches and the solution will be the implementation of much needed central control over the usage of sensitive data.

So, a new approach is needed. Sensitive data must be identified, classified and protected, through a single pane of glass methodology that applies the appropriate level of privacy controls to data according to sensitivity and usage requirements. If this is to be achieved, businesses must orchestrate and govern data privacy at a higher level that attains complete visibility and creates greater efficiencies while eliminating gaps.

This comprehensive data privacy management approach allows organisations to automate the process, maintain regulatory privacy compliance and create a balance between risk exposure and the need to use data for competitive advantage.

Find out more at iOCO, +27 11 607 8100, solve@ioco.tech, https://ioco.tech/




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Tech developments lead hologram growth in 2024
News & Events Security Services & Risk Management
Micro-lenses, micro-mirrors and plasmonics are among the rapidly-emerging optical devices that have evolved on the back of holographic and diffractive technologies, and are seen as part of the natural evolution of optical science by R&D teams.

Read more...
Are you leaving money on the table?
Editor's Choice Security Services & Risk Management
How many customers have you helped since starting your business? Where does most of your new business come from? If the answer is not from your database’s existing customers, you might have a problem.

Read more...
The business value of ChatGPT
Security Services & Risk Management Risk Management & Resilience
Transparency, policy and integrity. It is critical for organisations to have a line of sight into processes and procedures that clearly define employee use cases when it comes to ChatGPT, says Lizaan Lewis, Head of the Legal Department at Altron Systems Integration.

Read more...
BMS for smaller businesses
Security Services & Risk Management Products & Solutions Risk Management & Resilience
Small businesses can also benefit from tailored energy management solutions just like large corporations. Effective energy management is essential for more sustainable and efficient operations.

Read more...
Kidnapping for ransom
News & Events Security Services & Risk Management Risk Management & Resilience
There has been an 8,6% increase in reported kidnapping cases in South Africa compared to last year, with 3 854 cases reported between April and June this year, leaving ordinary South Africans increasingly vulnerable.

Read more...
The difference between a SOP and a SOP
Residential Estate (Industry) Integrated Solutions Security Services & Risk Management Risk Management & Resilience
SOPs are a touchy issue that need careful attention and automation to ensure they deliver the desired security results. Beyond design and automation, implementation is the ultimate road to success.

Read more...
Scoping out potential estates
Alwinco Security Services & Risk Management
When an intruder surveys a residential estate of 200 houses, they see at least 200 cars, 400 cell phones, 400 computers, 200 flat screen TVs, 600 bank cards, and various other items of value.

Read more...
Your face is the key
Suprema Editor's Choice Access Control & Identity Management Security Services & Risk Management Risk Management & Resilience
FaceStation 2, Suprema’s newest facial authentication terminal, is an access control, time and attendance terminal, featuring a better user experience with Android 5.0 Lollipop and Suprema’s latest algorithm, hardware, and software.

Read more...
Security without the skin
Alwinco Editor's Choice Security Services & Risk Management Residential Estate (Industry) Risk Management & Resilience
We all know about the layers of security required to form a comprehensive solution, but the layers go deeper than most consider. Andre Mundell dissects security in this article to start the journey into what is under the covers.

Read more...
Rack-mounted, three-phase online UPS
Security Services & Risk Management Infrastructure Products & Solutions
The new Eaton 93PX 15-20 kVA UPS combines high efficiency with a compact footprint, lower TCO, and improved cybersecurity to provide stable power for critical IT, industrial, manufacturing, and medical applications.

Read more...