Data Compliance and Protection Challenges

image of Keith A. Ferguson, CISA, CISSP, CRISC

About the author
Keith A. Ferguson, CISA, CISSP, CRISC

Some of the biggest challenges for financial institutions are the ongoing changes to data privacy laws.  Some of the critical challenges are associated with storing customers’ personal data and ensuring the confidentiality, integrity, and accessibility of the data. When data privacy laws change so do the requirements for demonstrating acceptable levels of due-diligence when institutions adopt new technology to serve their customers better. Also, there are requirements to continuously monitor and audit controls to ensure the controls are functioning according to accepted standards and best practices.

A breakdown in assessing technological risk is likely to have an unfavorable impact on information privacy.  Some of the negative consequences are:

  • Technological advances causing environmental, human and economic damage;
  • Increasing risk to the outage of a critical information infrastructure and networks, causing widespread disruption;
  • Large-scale cyberattacks causing extensive economic damage and widespread loss of trust in the Internet;
  • Massive incidence of data fraud and theft, resulting in the exploitation of private or confidential data.

These challenges and the associated technological risk can be addressed using various frameworks and standards, ranging from generic templates that provide blanket coverage to very specific solutions per individual data privacy laws.

Organizations and agencies such as the FDIC, Information Systems Audit and Controls Association (ISACA), and the Payment Card Industry (PCI) are constantly researching, evaluating and reacting to changes made regarding data privacy.

To adapt to these new challenges, organizations and various industries are joining forces to interpret the data privacy laws and reformulate and adapt existing frameworks and standards.

Some of the ways to effectively address the challenges associated with evolving data privacy laws, new technological advancements, and continuous monitoring are:

  1. Evaluate the latest versions of different frameworks, standards, and best practices and implement a robust governance framework;
  2. Deploy software tools of solutions to identify the usage of general and sensitive personally identifiable information;
  3. Establish and update an adequate internal control framework that includes data privacy, its related controls, and continuous monitoring, auditing of controls and regular reporting of the results.

Tackling these challenges should be part of a financial institution’s core business. It is vital to protect the organization’s resources and to maintain compliance. Addressing these challenges also provides the added benefit of gaining or maintaining customer confidence that the confidentiality, integrity, and accessibility of their information is adequately protected.