GRC

Could privacy by design (PbD) principles benefit your efforts to protect consumer and employee privacy? 

What Is Privacy by Design?

Privacy by design (PbD) is the philosophy of designing privacy protections into all your business processes, protecting the information your organization collects or handles by default. 

First developed by Ann Cavoukian, Ontario’s former Information and Privacy Commissioner, the PbD framework was formalized in 1995 by a team including the Dutch Data Protection Authority and the Netherlands Organisation for Applied Scientific Research. 

Starting from the premise that compliance with regulatory frameworks alone is not enough, privacy by design takes a “privacy first” approach. Logically, that should make compliance with privacy regulations easier to achieve.

For most organizations, the challenge is to keep innovating in the era of Big Data while safeguarding personal and confidential data at the same time. Finding that right balance is difficult for several reasons:

• Social networking and collaboration tools offer new possibilities, but can impose potentially serious vulnerabilities if not actively managed;
• Globalization fosters an environment where knowledge workers share information more readily, exposing organizations to a higher likelihood of information security breaches;
• Organizational boundaries are much more fluid, making it difficult to track how, where, and by whom information is stored, managed, or accessed.

Designers typically apply PbD to three areas of business operations: IT systems, business practices, and the physical, networked infrastructure. And while the principles of privacy by design work well in protecting all types of personal information, they’re especially important when safeguarding sensitive data such as medical or financial data. 

Privacy by design aims to preserve consumer rights by assuring privacy and giving consumers control over their personal information. PbD also allows organizations to gain a sustainable competitive advantage. It’s most successful when privacy is incorporated into tech and systems by default — that is, designing the product with privacy as a priority. 

PbD has existed as a best-practice framework since the 1990s. It became a requirement in 2018 with the passage of a groundbreaking European privacy law. 

Privacy by Design and the GDPR

The European Union’s General Data Protection Regulation (GDPR), a data protection law, went into force in 2018. It requires privacy by design as well as data protection by default in all uses and applications. 

Not only must organizations comply with the  GDPR; they must document their PbD development processes, and present that documentation to GDPR regulators in the event of a data breach or consumer complaint. 

European data protection and privacy laws are extra-territorial: they apply to all businesses that handle the personal data of EU residents, regardless of where the business is located or where the data is collected. If you serve European customers, you must comply with the GDPR. 

Software developers outside the EU should consider adopting privacy by design principles within the GDPR guidelines, to provide a clear, common-sense, accountable framework for any development process. 

The Principles of Privacy by Design 

Published in 2009 and adopted by the International Conference of Data Protection and Privacy Commissioners (now the Global Privacy Assembly) in 2010, Anne Cavoukian’s white paper “Privacy by Design: The 7 Foundational Principles; Implementation and Mapping of Fair Information Practices” establishes the following foundational principles for privacy by design:

1. Proactive not reactive; preventative not remedial.

The Privacy by Design approach is characterized by active rather than reactive measures, which anticipate efforts to invade privacy before they happen. PbD does not wait for privacy risks to materialize, nor offer remedies for resolving privacy invasion involving global laws and regulations. Privacy by Design comes before the fact, not after. 

Whether applied to information technologies, organizational practices, physical design, or networked information ecosystems, PbD begins with an explicit recognition of the value and benefits of adopting strong privacy practices, early and consistently, such as preventing internal data breaches from happening in the first place. This implies:

• A clear commitment at the highest levels of the organization to set and enforce high standards of privacy, generally higher than standards set by global laws and regulations.
• A privacy commitment shared by user communities and stakeholders, in a culture of continuous improvement. 
• Established methods to recognize poor privacy design, anticipate poor privacy practices and outcomes, and correct weaknesses well before they occur in an active, systematic, and innovative way. 

2. Privacy as the default setting.

Privacy by Design seeks to assure that personal data is protected automatically in any given IT system or business practice. If an individual does nothing, his or her privacy remains intact. No action is required on the individual’s part to protect privacy; it is built into the system by default.

This PbD principle is guided by the following Fair Information Practices (FIPs):

• Purpose Specification: the purposes for which personal information is collected, used, retained and disclosed shall be communicated to the individual (“data subject”) at or before the time the information is collected. Specified purposes should be clear, limited and relevant to the circumstances. 
• Collection Limitation: the collection of personal information must be fair, lawful and limited to what is necessary for the specified purposes. 
• Data Minimization: the collection of personally identifiable information should be kept to a strict minimum. No programs, communications technologies or systems should collect or process any personal information beyond what is immediately necessary.

Privacy must be embedded into technologies, operations, and information architectures in a holistic, integrative and creative way. “Holistic” meaning  additional, broader contexts must always be considered. “Integrative” meaning all stakeholders and interests should be consulted. “Creative” meaning that embedded privacy protections sometimes require an organization to reinvent existing choices because the alternatives are unacceptable. Wherever possible, identifiability, observability, and linkability of personal information should be minimized. 

• Use, Retention, and Disclosure Limitation: the use, retention, and disclosure of personal information shall be limited to the relevant purposes identified to the individual, for which he or she has consented, except where otherwise required by law. Personal information shall be retained only as long as necessary to fulfill the stated purposes, then securely destroyed. 
• Where the need or use of personal information is not clear, there shall be a presumption of privacy and the precautionary principle shall apply: the default settings shall be those that are most privacy-protective.

3. Privacy embedded into design

Privacy by Design is embedded into the design and architecture of IT systems and business practices. It is not added on after the fact. The result? Privacy becomes an essential component of the core functionality being delivered. Privacy is integral to the system, without diminishing functionality.

• A systemic, principled approach to embedding privacy should be adopted, one that relies on accepted standards and frameworks, amenable to external reviews and audits. All fair information practices should be applied with equal rigor at every step in the design and operation.
• Wherever possible, detailed privacy impact and risk assessments should be carried out and published, clearly documenting privacy risks and all measures taken to mitigate them, including consideration of alternatives and the selection of metrics.
• The privacy impacts of the resulting technology, operation or information architecture, and their uses, should be demonstrably minimized, not easily degraded through use, misconfiguration or error.

4. Full functionality: positive-sum, not zero-sum

Privacy by Design seeks to accommodate all legitimate interests and objectives in a positive-sum, “win-win” manner, rather than a zero-sum approach where unnecessary trade-offs are made. Privacy by Design avoids the pretense of false dichotomies, such as privacy versus security; it’s possible (and far more desirable) to have both.

• Embedding privacy into a given technology, process, or system should be done so that full functionality is not impaired, and that all requirements are optimized to the greatest extent possible.
• Privacy is often positioned in a zero-sum manner as having to compete with other legitimate interests, design objectives, and technical capabilities in a given domain. Privacy by Design rejects that approach. It embraces legitimate non-privacy objectives and accommodates them in an innovative, positive-sum manner.
• All interests and objectives must be clearly documented, desired functions articulated, metrics agreed upon and applied, and trade-offs rejected as often being unnecessary — all in favor of finding a solution enabling multi-functionality. 

Additional recognition is given to creativity and innovation in achieving all objectives and functionalities in an integrative, positive-sum manner. Entities that overcome outmoded zero-sum choices demonstrate first-class global privacy leadership.

5. End-to-end security: full lifecycle protection

Privacy by Design, embedded into the system prior to the first element of information being collected, extends securely throughout the entire lifecycle of the data involved. Strong security measures are essential to privacy, from start to finish, to assure that all data are securely retained, then securely destroyed at the end of the process in a timely fashion. Privacy by Design thus ensures secure management of information throughout the entire “information lifecycle.”

Privacy must be continuously protected across the entire domain and throughout the lifecycle of the data in question, with no gaps in either protection or accountability. The security principle has special relevance here; without strong security, there is no privacy. 

• Security: Entities must assume responsibility for the security of personal information (generally commensurate with the degree of sensitivity) throughout its entire lifecycle, consistent with standards developed by recognized standard-setting groups.
• Applied security standards must assure the confidentiality, integrity, and availability of personal data throughout its lifecycle. This includes methods of secure destruction, appropriate encryption, and strong access control and logging methods.

6. Visibility and transparency: keep it open

Privacy by Design seeks to assure all stakeholders that whatever business practice or technology involved, it operates according to the stated promises and objectives, subject to independent verification. Its component parts and operations remain visible and transparent to users and providers. Remember: trust but verify!

Visibility and transparency are essential to establishing accountability and trust. This PbD principle tracks to Fair Information Practices in their entirety, but for auditing purposes, special emphasis may be placed upon the following FIPs:

• Accountability: The collection of personal information entails a duty of care for its protection. Responsibility for all privacy-related policies and procedures shall be documented and communicated as appropriate, and assigned to a specified individual. When transferring personal information to third parties, equivalent privacy protection through contractual or other means shall be secured.
• Openness: Openness and transparency are key to accountability. Information about policies and practices relating to the management of personal information shall be made readily available to individuals.
• Compliance: Complaint and redress mechanisms should be established, and information communicated about them to individuals, including how to access the next level of appeal. Take necessary steps to monitor, evaluate, and verify compliance with privacy policies and procedures.

7. Respect for user privacy: keep it user-centric

Above all, Privacy by Design requires architects and operators to keep individual interests uppermost, using measures such as strong privacy defaults, appropriate notice, and empowering user-friendly options. 

The best Privacy by Design results are usually those consciously designed around the interests and needs of individual users, who have the greatest interest in the management of their personal data. 

Empowering data subjects to play an active role in the management of their own data may be the single most effective check against abuses and misuses of privacy and personal data. Respect for User Privacy is supported by the following FIPs:

• Consent: The individual’s free and specific consent is required for the collection, use, or disclosure of personal information, except where otherwise permitted by law. The greater the sensitivity of the data, the clearer and more specific the quality of the consent required. Consent may be withdrawn at a later date.
• Accuracy: Personal information shall be as accurate, complete, and up to date as is necessary to fulfill the specified purposes.
• Access: Individuals shall be provided access to their personal information and informed of its uses and disclosures. Individuals shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
• Compliance: Organizations must establish complaint and redress mechanisms, and communicate information about them to the public, including how to access the next level of appeal.
• Respect for User Privacy goes beyond these FIPs, extending to the need for human-machine interfaces to be human-centered, user-centric and user-friendly.
• Remove requirements for unnecessary app permissions, especially those that imply privacy invasion such as access to contacts or to the microphone. 
• Audit the security of your systems (see below) so informed privacy decisions may be reliably exercised. Similarly, business operations and physical architectures should demonstrate the same degree of consideration for the individual, who should feature prominently at the center of operations involving collections of personal data.

Privacy by Design: Right for You? 

Ensuring privacy and security through every phase of the data lifecycle (collection, use, retention, storage, disposal or destruction) has become crucial in avoiding legal liability, maintaining regulatory compliance, protecting your brand, and preserving customer confidence. 

Achieving PbD has a number of other benefits for organizations, including: 

• Assuring compliance by getting ahead of the legislative curve and minimizing compliance risk;
• Reducing the likelihood of fines and penalties, including financial losses or liability associated with privacy breaches;
• Building your brand by fostering greater consumer confidence and trust, thereby gaining a sustainable competitive advantage;
• Better managing of post-breach incidents, regaining consumer trust and confidence.

A Privacy Impact Assessment (PIA) is how you document the issues, questions and actions required to implement a healthy privacy by design process in a project. PIAs are a core requirement of GDPR; yours will determine what happens if you have a data breach or other privacy protection issue. In the event of a data protection issue, your PIA may determine the scope of an investigation by a regulatory authority. 

Auditing the security of your systems involves establishing adequate technical and security measures to protect user data. You must document these measures and provide the documentation to a regulator upon request.  

Lifecycle

• Minimize the amount of data you collect. 
• Minimize the amount of data you share with third parties. 
• Whenever possible, pseudonymize personal data. 
• Revisit contact forms, sign-up pages and customer-service entry points. 
• Enable the regular deletion of data created through these processes. 

User Engagement

• Provide clear privacy and data sharing notices. 
• Embed granular opt-ins through these notices. 
• Don’t require social media registration to access the app. 
• Don’t enable social media sharing by default. 
• Maintain best practices by seeking independent testing of privacy and security controls, rather than more self-reporting or testing.

Though there is no checklist of ready-made questions to help you achieve privacy by design, your organization can take these basic steps to achieve PbD:

Design Stage

• Create a PIA template for your business to use for all functions involving personal data (see below). 
• Review contracts with partners and third parties, ensuring the data you pass on to them is being processed in accordance with PbD and GDPR. Separate consent for essential third-party data sharing from consent for analytics and advertising. 

End of Engagement and Mothballing 

• Periodically remind users to review and refresh their privacy settings. 
• Allow users to download and delete old data. 
• Delete the data of users who have closed their accounts. 
• Delete all user data when the app’s life comes to an end. 

Privacy by Design: Other Recommendations

Companies processing certain kinds of data must appoint a Data Protection Officer (DPO) under GDPR. This person is legally accountable for your organization’s privacy compliance, including PbD. Your DPO does not have to be in-house or full-time. 

All organizations should consider voluntarily appointing a DPO to act as the “health and safety officer for privacy” and to keep the development process legally compliant.

Instead of viewing privacy by design as a checklist of boxes to be ticked because “the law says so,” organizations should use PbD to think creatively about all the ways user data can be misused, accessed, stolen, shared or combined. 

Adopting PbD into your development workflow is an opportunity to improve your policies, practices and products by incorporating privacy into your organization’s culture. Your users will be better protected, your organization’s reputation will improve, and you will be well on your way to healthy and legal compliance.

Privacy by Design and ZenGRC

Tools exist to help your organization with its compliance efforts. ZenGRC streamlines the execution of risk and compliance work, alerting you in real time to issues and vulnerabilities. 

ZenGRC can help you manage risk and compliance with confidence, providing a flexible solution that lets you find the optimal deployment based on your needs. 
Allowing you to easily remediate any weaknesses, either through security patches to software or through changes to data collection practices, ZenGRC helps your organization be better prepared to report risk assessments and remediations to other parties. 

Similarly, ZenGRC can integrate new threat alerts or updated regulations into your existing compliance program as they come along. 

Schedule a demo today to learn more about how ZenGRC can help you and your organization improve your cybersecurity posture.

Let’s give credit where credit is due. Spreadsheets have earned their keep, helping organizations manage GRC-related tasks for years. The use is so embedded within enterprises that, according to a 2020 Forrester Research study, 82 percent of organizations continue to use spreadsheets today to manage third-party risk.
And it has worked — to a point.
The challenge is that managing risk and compliance can feel like a never-ending game of dodgeball, constantly ducking and swerving, while keeping an eye on the next mandate and deadline looming around the corner. Operating on the defensive makes it nearly impossible to get ahead, hindering the ability to mature and evolve GRC programs to keep pace with company growth.
Using spreadsheets only makes it harder.
If you’re wondering if there is a better and faster (and much less exhausting) way to manage risk and meet compliance requirements, that’s a sure-fire sign your GRC program has outpaced spreadsheets. It may be time to investigate an alternative.
Here are five ways to drive GRC efficiencies with less effort, elevating your program to address new and evolving regulations:
Step 1: Be ready to move.
Once you decide to deploy a GRC platform, you want to be up-and-running fast. Time is of the essence when you’re on the hook to scale GRC activities while continuing to satisfy existing compliance requirements. A solution that can be deployed quickly delivers fast time-to-value, helping you generate ROI and ramp operations quickly.
Step 2: Start with one framework, map to many.
The beauty of an integrated and automated GRC platform is the ability to meet requirements for multiple frameworks, such as ISO, SOC and NIST, with unified control mapping. This allows you to standardize a common control set that is applied across compliance objectives and programs and backed by continuous monitoring to quickly satisfy new requirements with existing controls frameworks.
Step 3: Automate audits.
Build a comprehensive compliance and risk system with the ability to import external information, like vendor questionnaires and audits, and export internal information like regulatory reports. Leverage the same one-to-many mapping capabilities to identify control overlaps between compliance programs and easily audit and test once, applying the results many times over.
Step 4: Think about the future.
Turn to a platform that will scale as your organization grows, built to ramp beyond today’s compliance requirements, ideally able to support Enterprise Risk Management (ERM) and cybersecurity risk for improved information security. With one unified platform, accessed via a single interface, you gain a future-proofed foundation to manage comprehensive GRC.
Step 5: Partner with the pros.
To deploy quickly, get the most of your investment and build a more efficient and agile GRC program, lean on outside expertise where needed. Advice, support and analysis tied to specific regulations and frameworks can help take your program to the next stage of maturity.
But don’t just take our word for it. Take the word of one of our customers. 
Case in point: Datto, a provider of cloud-based software and technology solutions, was ready to make a move (remember Step 1 above?) — shifting from spreadsheets to a single system of record for compliance and risk management. Once the company had our fully integrated and automated ZenGRC platform in place, Datto put steps two through five in motion, building its compliance program from the ground up.
The results? Goodbye spreadsheets, hello greater efficiencies, fewer costs and less time. 

• Efficiency gains: Prioritized efforts based on existing control maturity and compliance and risk posture
• Cost savings: Immediate ROI with 35% reduction in external audit costs
• Time savings: Expedited gap assessments for SOC 2 from 8 months — to 45 minutes!

“We literally built our company’s compliance program around ZenGRC,” said Datto Director of Information Security Christopher Henderson. “And the more we use the platform, the more benefit we see.”
If you’re using spreadsheets to manage risk and compliance, you’re not alone. And if you’re looking for an alternative to make GRC management easier, faster and more efficient, you’re in good company. Uplevel your company’s compliance and risk management with a comprehensive GRC platform, establishing a foundation to ramp and scale with confidence.
To learn more about how ZenGRC powered greater GRC efficiencies for Datto, read our case study Datto Builds Compliance Department Around ZenGRC.
Read Case Study

An incredibly powerful economic force, mid-market organizations employ more than one quarter of the U.S. workforce. They were integral to driving the economy forward in the years following the Great Recession and will no doubt play a key role as we look for ways to grow the economy as we recover from the COVID-19 pandemic.

For the past year, CIOs of mid-market companies have been focused on enabling seamless, remote operations for their businesses. As part of this digital transformation, their infosec teams have often scrambled to establish new security infrastructures, access points and processes for entire workforces. And they’ve had to do in days what previously would have taken months (or even years) to successfully complete.

With this heightened awareness of and focus on information security, we wondered what CIOs are struggling with in today’s “new normal” business environment. So we surveyed 50 mid-market CIOs representing IT leadership across multiple industries nationwide to understand the challenges they are experiencing, what they need to succeed and how they can better achieve their GRC goals. Here are three key takeaways:

1. The majority of CIOs are struggling with limited resources and budget.
   Regardless of the industry, they are all being asked – and expected – to do more with less, whether it’s in terms of creating secure network infrastructures, staying on top of ever-evolving regulatory changes or managing an increasingly diverse set of business risks. They can’t allow anything to fall through the cracks, which means they need to carefully manage their GRC resources and processes to ensure they are getting the most out of their investments and building more efficient GRC programs.
2. The top priority for CIOs in 2021 is to increase their GRC budgets.
   This is no surprise, considering the previous takeaway. While clearly feeling constrained by their current budgets, our CIO respondents were clear that the only way they can continue to deliver new initiatives and transformational improvements that will drive their business forward – with no interruption to current business operations – will be to invest in technologies that will improve and automate their GRC programs.
3. CIOs rank automating the GRC lifecycle the most beneficial feature of a GRC solution.
   The time- and cost-savings of automating and streamlining compliance processes and audit cycles speak for themselves. However, for a GRC program to be truly effective, it needs to empower infosec teams to quickly and accurately understand the data they control, where it exists and how to properly secure, access and manage it. A GRC solution that automatically updates frameworks and enables teams to monitor both internal and external risks across the entire organization can take GRC programs to the next level.

We’re still learning from 2020. But thanks to the rapid responses of CIOs, businesses are better-equipped to face disruptive new challenges in the years ahead. By quickly evolving their infosec strategies and harnessing new GRC technologies, mid-market CIOs have the ability to power greater business efficiencies while driving business growth.

To learn more about what CIOs are focused on in 2021 and how they plan to lead their organizations into their new normal, read our original research study Today’s CIO Imperative: Driving Greater GRC Efficiencies: How mid-market CIOs are leading GRC initiatives in the year ahead.
Read Report