Data Compliance

Why is data compliance important?

Fundamentally, compliance is good for business. Becoming compliant requires new ways of handling data that make your company more secure and efficient. Furthermore, demonstrating that your information security practices conform to compliance frameworks like SOC 2 reinforces your brand’s trustworthiness with customers and partners.

In many cases, it’s also the law. Legal frameworks like Europe’s General Data Protection Regulations (GDPR) make companies responsible for safeguarding European residents’ personal information and keeping it private. In addition, these regulations require:

• Obtaining consent for data collection
• Providing individuals access to their data
• Allowing individuals to request changes or deletions to data
• Notifying authorities of data breaches

Non-compliance with security and privacy regulations can lead to stiff penalties — in the case of GDPR, as much as ten percent of global revenues.

What does a data compliance officer do?

A data compliance officer (DCO) is a senior-level executive responsible for ensuring compliance with every framework the company adopts. The DCO’s duties may include:

• Developing data compliance policies.
• Monitoring and enforcing compliance.
• Coordinating audits and internal reviews.
• Contributing to risk management programs.
• Promoting compliance awareness.
• Liaising with regulators and law enforcement organizations.

By contrast, a data protection officer (DPO) is only concerned with the company’s compliance with GDPR. Any organization subject to GDPR must hire a DPO and give them complete independence, answering only to top management.

What is the difference between data compliance and data protection?

The difference between data compliance and data protection is the difference between “what” and “how.”

Data compliance comprises a set of requirements, standards, and policies that the company must adopt to keep data private and secure.

Data protection consists of the technologies, processes, and procedures that put compliance requirements into effect.

Limitations of data compliance regulations

Security and privacy regulations set minimum standards for protecting data while giving compliant organizations some protections against civil actions. Regulations are also stable, making compliance initiatives easier to plan and manage over several years. However, this stability creates problems of its own.

No agility in dynamic conditions

Regulatory cycles span decades, while data and security landscapes can transform seemingly overnight. For example, generative AI was laughably bad in mid-2022. Now, risk managers prohibit its use in the enterprise due to potential privacy, security, and intellectual property risks.

Static regulations do not adjust to these changes in real-time, leaving compliance officers to find ways to protect data from emerging threats.

Regulations are guidelines, not specifications

Security frameworks define the security issues organizations must address. They do not tell organizations how. On the one hand, outcome-centered regulations give companies flexibility. How a globe-spanning enterprise and a local startup achieve compliance will be quite different.

On the other hand, regulatory flexibility creates a grey area. A compliance program may seem acceptable to company leadership, but will their decisions hold up in court?

Cross-border compliance is challenging

Companies with international businesses must comply with regulations everywhere they operate. That’s getting increasingly complicated.

The United Nations reports 137 countries have data privacy and security regulations. Despite their similarities, none are identical. Adding to this complexity are the data sovereignty laws more countries are enacting.

Compliance programs must ensure data remains within each country and that access controls enforce each jurisdiction’s rules.

Benefits of data compliance

Although compliance is resource-intensive, improving your company’s security posture and protecting data privacy creates long-lasting benefits.

Compliance makes you more efficient

Compliance initiatives streamline your data storage and data management systems. For example, compliance standards often encourage data minimization— only collecting and keeping the least data your business needs. Evaluating why you need, how you collect, and when you delete data will help counter the rising floods of data.

Compliance improves data security and privacy

Meeting data compliance requirements will result in more robust and effective cybersecurity systems that reduce the potential for, and impact of, data breaches.

Moreover, a security policy based on principles of least privilege reduces the risk of unauthorized access to protected personally identifiable information.

Demonstrating compliance builds trust — and growth

Many voluntary compliance frameworks include an independent auditing process that documents the effectiveness of an organization’s security controls.

Data service providers, for example, will ask accounting firms to audit their controls. The resulting System and Organization Controls 2 (SOC 2) report is a gateway to landing customers concerned about their vendors’ ability to protect data.

Compliance mitigates risks

A well-managed compliance process reduces many security, financial, and reputational risks. For example, many frameworks require encrypting protected data, whether at rest or in transit. Complying with this requirement reduces the risk of data loss from a security incident. More importantly, regulations protect companies that encrypt their data from civil lawsuits.

Data compliance standards, regulations, and legal requirements you should know

When creating a governance program, companies must decide which mandatory and voluntary security frameworks apply to their business. The key to streamlining compliance is mapping similar requirements, so the same controls serve every framework.

General Data Protection Regulation (GDPR)

The European Union issued a privacy directive in the mid-90s that defined its citizens’ data rights. However, it was up to each company to decide whether and how to protect these rights. When GDPR went into effect, Europeans gained new privacy rights, including:

• The right to be informed of data collection and use.
• The right of access to collected information and the reason for its use.
• The right to correct or erase personal information.
• The right to be forgotten.
• The right to restrict processing.
• The right to data portability.
• The right to object to the processing of personal information.
• The right to refuse automated decision-making and profiling.

Any company, no matter where it is based, is subject to GDPR if it collects, handles, processes, or uses the personally identifiable information of an EU resident.

GDPR compliance goes beyond implementing security measures. The regulations require data protection to be “by design and by default,” meaning companies must incorporate GDPR principles when developing new products or processes that involve personal data.

California Consumer Privacy Act (CCPA)

Privacy regulation in the United States is more fragmented. Without a comprehensive federal law, each state enacts its own. The most far-reaching state privacy law is California’s CCPA. As with GDPR, CCPA defines the rights of California residents.

• The right to know: companies must inform consumers of the data they collect, how they use personal data, and what they share with other companies.
• The right to correct: companies must let a consumer correct collected information.
• The right to delete: companies must delete personal information upon request.
• The right to limit: companies must stop sharing a consumer’s data upon request.
• The right to opt-out: companies must let consumers opt-out of data collection activities.
• The right to non-discrimination: companies cannot deny service or otherwise discriminate against consumers who exercise their CCPA rights.

The CCPA also gives California consumers the right to sue companies that lose their personal information in a security breach.

Health Insurance Portability and Accountability Act (HIPAA)

Among other reasons, Congress enacted HIPAA to protect personal health information (PHI) in America’s increasingly digitized healthcare system. As with GDPR and CCPA, HIPAA establishes patient rights over their medical information:

• The right to access PHI
• The right to correct PHI
• The right to know how PHI is used and shared
• The right to block sharing of PHI

The regulations extend beyond clinics and hospitals to insurance providers, payment processors, laboratories, and any company that stores or processes PHI. These covered entities must comply with several groups of HIPAA rules:

• Privacy Rule: Defines PHI and the safeguards organizations must adopt to preserve patient privacy.
• Security Rule: Describes the administrative, physical, and technical safeguards organizations must implement to protect PHI confidentiality, integrity, and security.
• Enforcement Rule: Defines the penalties for non-compliance.
• Omnibus Rule: An update to HIPAA that includes breach notification requirements.

Other notable data compliance standards and regulations include

Federal cybersecurity frameworks

• National Institute of Standards and Technology (NIST) SP 800-53
• NIST Cybersecurity Framework
• US Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC)

Industry security frameworks

• Payment Card Industry Data Security Standard (PCI DSS)
• System and Organization Controls 2 (SOC 2)
• ISO/IEC 27001

National data privacy legislation

• Australia: Australia Privacy Act
• Brazil: Lei Geral de Proteção de Dados (LGPD)
• Canada: Personal Information Protection and Electronic Documents Act (PIPEDA)
• Singapore: Personal Data Protection Act (PDPA)
• South Korea: Personal Information Protection Act (PIPA)
• Turkey: Personal Data Protection Law (PDPL)
• United Kingdom: Data Protection Act 2018