Announcing $50M Series B funding to further accelerate our rapid growthView More
A Data Subject Access Request (DSAR) is the means by which individuals request that your enterprise discloses what personal data it holds on them and how you use or intend to use it. Submitting DSARs is one of the Data Subject Rights granted to consumers under data privacy laws such as the California Consumer Privacy Act (CCPA) and the European General Data Protection Regulation (GDPR). These laws not only give consumers awareness about their rights over their personal data but also provide the tools necessary to exercise them. An enterprise served with a DSAR is legally obligated to fulfill these requests within a limited timeframe to avoid non-compliance. This is why automating the processing of DSARs is necessary to respond within the aforementioned timeframe. So, let’s discuss the importance of DSARs, how they differ under CCPA and GDPR, and how your business can cost-effectively prepare for and automatically respond to DSARs, which are likely to increase substantially in a post-CCPA world.
DSARs give consumers unprecedented control over their personal information stored by organizations, from access to data and requesting information on stored data to requesting information on the data safeguards the organization provides. With CCPA, consumers can request DSARs twice a year at no cost whatsoever.
For businesses, speedy and accurate fulfillment of DSARs substantially boosts their brand image while also ensuring compliance with CCPA regulations. However, some estimates put the cost of the fulfillment of each DSAR could be in the thousands, since it requires data gathering across a multitude of systems, putting them in one place, going through data records and compiling it all in a comprehensive report. Moreover, fulfilling each DSAR can take weeks. This is where a solution based on automation can be a potent weapon.
While both CCPA and GDPR provide consumers with mechanisms to exercise greater control over their data, there are some fundamental differences between how much power a consumer has under each law. Let’s have a look:
Many expect that the number of DSARs received will increase significantly once CCPA goes into effect on Jan 1, 2020. So let’s explore what is required and how to prepare:
Organizations have 45 days to respond and fulfill a customer’s data subject request, in a transferable electronic format. These obligations may vary depending on the customer’s request and how their information is handled.
Deletion requests involve not only team members from within the organization, but also all third-party vendors and partners with whom the personal information has been shared.
CCPA requires the disclosure of rights and communication about DSARs, as does the GDPR. The rights given to consumers under CCPA and GDPR are similar but not identical. This means that organizations will need to change their communication accordingly.
The following are the steps required to process and fulfill a DSAR:
Here are several risks associated with fulfilling a data subject request you must watch out for:
One important factor to consider is that using traditional means will do more harm than good. For example, using emails to deal with DSARs can be dangerous as the risk of data sprawl increases when sending and receiving data over a system that is not secure. Moving personal information in an unencrypted system increases the risk of data breaches. It takes an average of 196 days for an organization to pick up on a data breach, making it essential for enterprises to fortify and automate their systems to protect themselves from any data breach.
Here are some highlights:
Large organizations may have hundreds of millions of records about their consumers, often spread across an array of systems. Sorting this data and creating a data inventory to cope with DSARs is a challenging task that requires organizations to automate their current practices.
At PRIVACI.ai, we have solutions that offer robotic automation, machine learning and secure cross-channel collaboration to help your business stay prepared for CCPA.
To learn more about automation and orchestration of data subject requests and how much time you can save, check out the video below or schedule a demo to see it live, in action!
If you’re reading this, you care about data privacy. Maybe you care about it in the scope of your job responsibilities, or perhaps you care about it personally: in the scope of your own personal life and technology use. But more likely than not, it’s a mix of the two. This is why automation of privacy efforts – and PrivacyOps -- matters. Curious? Read on.
We didn’t get here by accident. Governments around the world have not enacted data-centric regulations such as GDPR and the California Consumer Privacy Act (CCPA) out of the pure goodness of their hearts. These laws are largely in response to growing public and awareness and outcry over-exploitation of sensitive personal information: personal information that individuals feel they often have little choice in providing or controlling if they are to participate in modern society. Pick your favorite headline about a breach or data privacy violation; data privacy awareness is high and growing.
The research done by 451 Research also corroborates this. In one of our consumer survey cycles, we asked individuals how concerned they were about data privacy. A full 90% reported they were either “very concerned” or “somewhat concerned.” Only 1% reported they were “not at all concerned.”
That type of awareness is hard to ignore, and in the US, individual states are rapidly enacting legislation for data privacy and protection: following in the footsteps of California. But for businesses looking to comply with these regulations, the landscape is treacherous. Not only does California’s law – CCPA – have extraterritorial reach, but all of the individual state proposals for laws are slightly different, leading to balkanization of data privacy and protection standards in the US. Interstate organizations in the US, then, cannot sustainably approach each new regulation with an ad hoc “Whack-a-Mole” approach. They need privacy programs that are adaptable, scalable, and that leverage automation to execute data management tasks common to multiple regulatory frameworks.
But what, exactly, is the common denominator across these increasingly diverse data protection and privacy mandates? It is often easier to get caught up in the individual nuances and “checkbox” requirements of each than it is to identify core underlying principles. Identifying differences can give the organization a deceivingly simple “to-do” list that misses the big picture. In reality, data privacy and data protection regulations fundamentally exist to protect the rights of individuals, and to protect the rights of individuals, organizations need full control of ALL the personal data in their possession.
Across data privacy and protection regulations, individuals are generally given the “right to know” and the “right to say no” with regard to their data. The right to delete personal data, the right to data portability, the right to reasonable security for personal data, and the right to be notified in the case of a data breach are also all very common. Again, organizations must have a very granular understanding of what personal data is in their possession and what is happening to it at all times if these basic rights are to be fulfilled. Not knowing is not an excuse.
Unfortunately for businesses, data is more difficult to control and understand than ever before. Once personal data is ingested into an organization, it propagates into countless internal systems and data silos, and can make its way to dozens or even hundreds of third-party vendor systems that the original organization has limited control over. A growing number of end users demanding data within organizations also complicates the management of appropriate access and permissions.
And the diversity of the average business IT environment is simply staggering. According to 451 Research’s enterprise practitioner survey results, 72% of organizations that use the public cloud use more than one public cloud vendor, and a total of 8% used more than three public cloud vendors: an impressive feat considering only three public cloud providers dominate the market in the US. For organizations with 1,000+ employees, a full third – 33% -- report having more than 50 distinct departmental data silos. That’s a lot of disparate data sources to manage.
These factors amount to a perfect storm. Growing public outrage and awareness, proliferating regulations, sprawling IT ecosystems, an expanding pool of self-service data consumers, and the intensifying enterprise pressure to extract maximum insight from all available informational resources.
We’re at the end of an era; gone are the days where “reactive” business functions such as compliance and data privacy could be at odds with more “proactive” enterprise insight initiatives such as analytics and data science. In an era of rapid disruption, organizations that want to survive must align their business objectives such that data privacy and protection is no longer a burden or cost center. Rather, it must be an accelerator for better data management architecture and practices which will benefit all stakeholders.
In this context, data privacy and protection efforts are deeply intertwined with the viability of the business and the ability to meet the needs and expectations of customers: particularly in the B2C space. So, it should go without saying that data privacy and data protection needs to be an ongoing, iterative, adaptable process rather than a project-based “checkbox” approach with a deadline. New regulations will always emerge; it is up to organizations to implement processes and technology that can support evolving needs rather than just the specifications of a single law.
Automation will be critical. There is no amount of human talent and effort sufficient to scale to the data management volume challenges within a typical modern organization. There is simply too much data to evaluate and protect. Capabilities such as automated detection of potentially-sensitive data sources, automated policy controls for data, automated control of data access rights, and automated fulfillment of data subject access requests (DSARs) are all possible and – increasingly – necessary.
The PrivacyOps concept and framework looks to operationalize data privacy practices across the organization, leveraging automation, so that not only compliance objectives can be met, but so that the friction of end user data access and leverage can be reduced. Better data management and data privacy controls, when implemented correctly, can actually free up data that was formerly locked away in silos. To the average business end user, such as a data analyst, an effective PrivacyOps program will be invisible and simply make access to appropriate data sources quicker and more seamless.
What does PrivacyOps look like? It is a framework, rather than a specific tool, that takes into account people, processes, and technology. Emphasis on automation of error-prone and high-scale tasks is a must. At its most rudimentary, it breaks down into the convergence of four basic “systems:”
It’s time to stop thinking of data privacy and data protection as a burden, a barrier, or a niche responsibility within the organization. Responsible use of data, and the data management practices that enable it, can benefit everyone: from those depending on high-quality information to those that depend on the trust of consumers to cultivate long-lasting, profitable relationships.
Yes, organizations will need to leverage automation and technology to achieve these objectives. But ultimately, the discussion needs to start with business stakeholders. Getting everyone in alignment should be the first step, and establishment of effective and adoptable processes should be next. Finally, appropriate technology tools should be considered, selected, and implemented.