Data Privacy

• Evaluating privacy operations and data protection methods
• Assessing data privacy and data governance program maturity
• Developing a roadmap to implement data privacy & governance programs
• Evaluating the records management process and procedures
• Classifying and identifying data inventory(s), including critical data elements
• Evaluating data privacy and governance programs against industry standards to meet compliance obligations
• Identifying risks impacting the data privacy and governance programs and prioritize mitigating activities

As data privacy laws and regulations are drafted, modified and enacted, businesses are examining and updating their data privacy compliance and governance structures in an effort to comply with the evolving requirements. With a direct effect on the controls and standards organizations must maintain, the requirements are influencing decisions to implement new technologies and update processes over maintaining private information. With an effective data management program, organizations are able to comply with requirements while reducing overall data privacy risks.

The laws and regulations include:

• Federal Trade Commission Act (FTC)
• Health Insurance Portability and Accounting Act (HIPAA)
• Children’s Online Privacy Protection Act (COPPA)
• Gramm Leach Bliley Act (GLBA)
• Fair Credit Reporting Act (FCRA)
• Family Educational Rights and Privacy Act (FERPA)
• California Privacy Rights Act (CPRA)
• Virginia’s Consumer Data Protection Act (CDPA)
• Colorado Privacy Act (CPA)
• Utah Consumer Privacy Act (UCPA)
• Connecticut’s Data Privacy Law (also known as “An Act Concerning Personal Data Privacy and Online Monitoring” (CTDPA))
• New York Stop Hacks and Improve Electronic Data Security Act (SHIELD)
• Iowa Consumer Data Protection Act (ICDPA)
• General Data Protection Regulation (GDPR)
• Digital Services Act (DSA)
• Digital Markets Act (DMA)
• Brazil’s General Law for the Protection of Personal Data, or the Lei Geral de Proteção de Dados Pessoais (LGPD)
• China’s Personal Information Protection Law (PIPL)
• Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA)
• European Union’s Artificial Intelligence Act (AI)
• European Union’s E-Privacy Regulation (ePR)
• EU-US Data Privacy Framework

Like any physical asset, the data a company possesses can be equally valuable. An organization should possess a complete record of what data it has, which systems and individuals use that data, and where that data travels within and outside its own IT ecosystem. With an effective data governance program, organizations are able to:

• Improve data discovery efforts at the organization
• Improve data governance actions across the organization
• Inform decision making of the organization in short-term or long-term strategy
• Inform product development decisions
• Assist in appropriately funding strategic initiatives
• Create legal artifacts that document the existence and location of data
• Remove unnecessary data collection activities