Worldwide, data has become the most valuable commodity and is now generated and consumed at unprecedented rates. Before moving any data outside their organisation, organisations must first consider the issues surrounding data access, security governance, risk and compliance management. This process involves evaluating the entire lifecycle of data throughout the organisation, through intake and ingestion, cataloguing, persistence, retention, storage, sharing, archiving, backup, recovery, disposition, to removal and deletion.

Mitigating risk with compliance

As the most valuable commodity, there is a danger that organisations will opt for risky data storage practices or shortcut their obligations to consumers, putting them at risk in the name of profit. 

Regulators must step in and legislate to ensure that companies cannot operate in a way that makes them liable for that risk. The EU GDPR, introduced in May 2018, set out to do this by holding companies accountable internationally for protecting the data of EU citizens by introducing heavy fines for non-compliance. The California Consumer Privacy Act (CCPA) has followed suit, bringing into law additional protections for the consumer. There are many commentaries about whether these legislative changes have been successful; however, there is undeniable and increasing regulatory pressure on data governance.

Taking ownership of data governance 

Organisations, both buyers and sellers, are finding that they now need to ask themselves who is responsible for data governance and what they need to do to ensure adherence.

There are arguments for whether this task belongs to compliance, legal, IT, or even finance teams; however, the oversight isn’t as important as the implementation. It is critical to identify data owners (custodians) who understand the data’s nature and the processes surrounding it. Companies should look to nominate the person with the best skills and position to oversee data governance and ensure that this is supported and pushed down onto those in the business closer to the problem.

Expert advice- 5 top tips 

The smartest approach to mitigating your compliance risks is through the following steps: 

1. Understand and document the data you have
2. Classify that data – understand the nature of it and which compliance regulations it relates to
3. Define ownership of that data within the organisation and understand access control
4. Implement the necessary people, process and technology controls to ensure that the data is protected
5. Prepare to do this on an ongoing basis as part of ‘business as usual.’ Data governance fails when it is treated as a one-off exercise.

Find out more about SureCloud’s cloud-based Governance Risk and Compliance (GRC) software solutions.