ENSURING DATA PROTECTION

Madan Mohan, Director — Technology Risk Advisory, MBG Corporate Services on the growing need for organisations to incorporate privacy laws and regulations within their structures

In our daily lives in this digital world, we often accord higher value to convenience than to the security of our data. However, the threat to our personal data, which increasingly accompanies or even determines many of our important personal decisions, such as securing a loan or buying an insurance policy, is immense. The risks range from spam emails, to the more serious matter of identity theft and other variations of organised cybercrime. Hence, trust — whether an individual can leave their data with a second party without the latter sharing it with third parties — is too big a factor to leave unregulated anymore. And that is where data protection and privacy laws come in.

Companies today face increasing pressure from regulators and the marketplace to improve how they collect, use, store and delete personal information, and how they manage data privacy. Frequent high-profile data breaches by some of the largest companies in the world over recent years has led to growing focus on privacy rights, leading to increasingly strict data protection enforcement.

Data privacy is a combination of legal, compliance, technology and cyber security elements; cyber security perhaps being the most important one, not only in protecting data from external and internal threats, but also in determining how digitally stored data can be shared and with whom.

Recent data from Risk Based Security, a research company, revealed that the number of records exposed to cyber harm increased to a staggering 36 billion in 2020. There were 2,935 publicly reported breaches in the first three quarters of 2020, making it the ‘worst year on record’.

What is data privacy law?

Data privacy laws protect individuals’ privacy by empowering them with ownership rights over their personal data. According to UN statistics, 128 out of 194 countries have put in place laws which ensure personal data privacy. Africa and Asia have a similar level of adoption with 55 per cent of countries having adopted such legislations, of which 23 are least developed countries. Of these regulations, the European Union’s GDPR (General Data Protection Regulation), which requires businesses to protect the personal data and privacy of EU citizens is perhaps the most well-known. Many other data protection regulations have been inspired by and modelled after the GDPR, making interpretation easier.

Data privacy laws deal with the control process around sharing data with third parties, how and where that data is stored, and the specific regulations that apply to those processes.

Recently, the ‘Personal Information Protection Law 2021’ in China and the ‘Data Protection Law 2021’, in the UAE respectively, have been enacted, further improving the country’s international business and personal data security outlook.

Why is it important?

One of the main reasons why companies comply with data privacy regulations, is to avoid fines and penalties. However, it goes well beyond that. You must take data privacy seriously in this age of consumer-citizen activism and consciousness with powerful considerations as ethics, corporate governance, and brand equity. Compliance does the following:

Boosts corporate brand perception as an ethical, socially responsible business

Improves the security structure of the organisation

Gives organisations better control over data that protects their consumers’ rights

Naresh Manchanda, CEO — Risk, Technology and Foreign Enterprise Group, MBG Corporate Services said: “Data, its governance and protection is critical for the sustainable growth of any organisation. Entities should consider full governance and protection by design. They should assess multi-dimensional risks at regular intervals and continually enhance their data privacy framework. Societies must work together as a public-private partnership in spirit and letter. Hence, governments and organisations as well as individuals too must be aware and vigilant about their data usage, protection and stay alert to any breach or misuse.”

Privacy laws and regulations should be considered part of organisational culture and not merely as regulatory compliance. A strong data culture protects organisations’ businesses and reputations by preventing data breaches and cybercrimes.