Regardless of industry, no company can escape the widespread reach and impact of data. Whether a company is collecting account information from customers or aggregating platform usage data, handling large amounts of data has become the norm. While this creates boundless new opportunities for businesses in analytics and real-time decisioning, it also introduces new risks that organizations need to consider and prevent where possible.
Data can be both an asset and a liability, especially as it pertains to customer information. In addition to complying with laws such as the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Protection Act (CCPA) in the United States that outline rules for handling customer data (as well as punishments for failure to handle data appropriately), it’s important for businesses decide on their own standards for data storage, transmission, and retention.
Beyond legal ramifications, the loss or misuse of personally identifiable information (PII) can also cause irreparable damage to the trust and relationship between a company and its customers. To avoid this, organizations should plan for security when designing systems that will collect and use customer data. Some guiding principles businesses should follow to ensure security and privacy are fundamental aspects of their system design include:
Understanding data sources
Before an organization can identify the proper data handling standards it should abide by, it’s important to first consider where its data is coming from. This will determine the extent to which the data needs to be protected. For instance, a customer’s billing information is much more sensitive than web traffic data and therefore will require much more stringent data protection methods.
One way businesses can more easily identify data sources and build security models that are appropriate for each data type is by implementing proper data categorization. Some common data categories include customer data, proprietary data, and technical data. By categorizing data, it becomes much simpler to decide how data should be stored, protected, and retained.
Being purpose-driven
All data that a business collects should serve a clear and distinct purpose. Some data will fulfill short-term purposes (such as technical logs used for debugging purposes), whereas other data will fulfill longer-term purposes (e.g., billing records until the next tax season). Whatever the case may be, the purpose will help guide decisions about how data is stored and protected.
Purpose-driven data collection can also help assess which teams require access to which data. For example, employing role-based access control (RBAC) can ensure that only employees with a legitimate business need can access the data. Actively controlling access by job role, rather than by the individual, eases the burden of access control management while ensuring that an individual can only access the systems within their scope of work.
Devaluing data no longer in use
Just as important as determining where data should live and why it is living there, is determining how long it should live there. While it can be tempting to retain records indefinitely, data does not stay relevant forever. Stored information will likely grow stale, and its value will diminish with time. In order to keep data relevant, companies should consider aging off data that is no longer needed, with the goal of keeping data for the minimal time necessary to fulfill its reason for collection.
To figure out when it’s time to devalue data, businesses should ask questions such as: When was the last time this data was used? When will we use this data again? How much does storing this data cost? And what is the risk of losing this data should a breach happen? Data kept beyond its usefulness not only costs the company money to retain but also increases their liability if hacked. By devaluing data, companies can avoid hanging on to data that is no longer useful but potentially risky.
Making security a feature, not an afterthought
Security is not something to delay until the end of the system design. Waiting until a system is fully built out before considering how to protect the data within it will leave a gap of time in which the data is insecure. Consider for a moment building a bank vault. A bank wouldn’t allow people to deposit money into the vault before they figured out ways to keep that money safe. They instead create a plan for keeping that money safe before it is their responsibility to protect it. These same principles apply for data storage; building in security from the ground up helps ensure that potential gaps are addressed prior to implementation.
Organizations need to ensure that their customer data is protected both “in transit” (the process of collecting the information from the source) and “at rest” (the final storage point for the data). The extent to which you need to protect that data, the ways in which you implement that protection, and the length of time you retain that data should all be purposefully designed based on your data categorization and use case.
In today’s increasingly data-centric world, data security cannot just be an optional add-on. Instead, it can be a powerful marker of good business operations by demonstrating an ongoing commitment to protect customers and partners both now and in the future. Protecting and safely handling customer data should be a critical priority for all organizations.
