While regulatory compliance is nothing new to cybersecurity professionals, many organizations still have concerns about their compliance with the European Union’s General Data Protection Regulation and the rollout of the California Consumer Privacy Act.

Many of the same security controls that organizations measure to demonstrate compliance with regulations such as the Payment Card Industry Data Security Standard and HIPAA, or even security due diligence, will serve those organizations well as they seek to establish programs that are GDPR and CCPA compliant.

Let’s take a look at some simple things that you can do to either shore up your existing privacy program or establish a new one.

On the TV show Hoarders, the subjects of the program often explain that they allow apparently useless items to pile up around their houses because they might need them someday. Regardless of its implications for household décor, this is a poor model for data management, but we see some organizations follow it nonetheless. In some…

When the European Union’s General Data Protection Regulation went into effect in May 2018, it posed a challenge for many organizations. But with more than a year of experience under their belts, most have been able to work through the growing pains of compliance and settle into new operational routines. Now that most of us…

Retailers that do business in the European Union are settling in to the new normal of operating under the privacy and security provisions of the General Data Protection Regulation. In the early days, retail IT teams paid significant attention to the structure of their back-end systems, trying to understand how to modify them to meet…

Last year, the world of privacy and security compliance was obsessed with one key date: May 25, 2018 — the day the European Union’s General Data Protection Regulation went into effect, mandating sweeping changes in the ways organizations handle personally identifiable information belonging to EU residents. This year, we have a new date on the…

In May, the digital world was awash in privacy practice notifications that inundated users on websites and in email inboxes. This wave came as companies doing business in the European Union prepared for the implementation deadline of the General Data Protection Regulation. Talking heads fueled a media frenzy of speculation regarding when EU supervisory authorities…