Data Discovery: Advancing your privacy program

Prior to the General Data Protection Regulation (GDPR) and other privacy laws, companies felt entitled to unlimited source and unregulated access to personal data, hoarding it with no clear business intention.

The data is collected through various channels, dispersed across IT systems, undetected, unprotected, unused, and perhaps lost. However, it still exists and holds companies accountable. 

With the shift in customers’ expectations, an increase in data breach numbers, and high data maintenance costs, privacy-progressive companies are revisiting how they manage, catalog, and profile personal data to avoid unnecessary data protection risks.

To make that shift, organizations will likely have to rely on a data discovery solution to manage personal data in a compliant way and get actionable insights into personal data processing.

We will review the challenges, risks, technical and organizational issues, and solutions to these problems.

Why discovering data is not easy

Data Discovery is not easy because getting the results you trust is almost impossible. Suppose you tried to conduct data discovery in your organization without a proper data discovery solution.

 You might already know that going through large volumes of data and manually labeling personal data types consumes a lot of resources with questionable results.

On the other hand, we have experienced a multitude of problems when mapping personal data for our clients with other data discovery tools.

We could never fully trust the information it provided, mostly because the existing software could not scan both structured and unstructured data or data in languages other than English.

These problems would result in an incomplete and erroneous data inventory, which proved detrimental to any privacy program’s success.

That is why we have invested in building a DPM data Discovery software we can trust. This way, privacy teams do not have to rely on anyone in the company to provide information about the types of personal data they store and use correctly. They can search and discover personal data independently.

Data Discovery and GDPR

Organizations are accountable for the compliant collection and processing of personal data. After you collect personal data based on consent, legitimate interest, or any other appropriate lawful base, it is important to keep track of:

• Where is personal data stored?
• What types of data do you collect?
• Which data categories do you hold?
• Are there any organizational or technical measures that need to be implemented?
• For how long can you keep personal data?
• Who has access to that data?
• Can you respond to data subject requests?

If you don’t know where your data is, it is impossible to respond to any of those questions and adequately protect personal data.

As an organization, you are accountable for the data you know you have and for personal data hidden across all your systems.

GDPR requires you to adequately manage personal data you collect, not to mention being able to fulfill your obligations towards individuals, like responding to data subject requests or deleting data you no longer have use for.

How to approach Data Discovery in your company

1. Discover personal data

Identifying personal data scattered across multiple IT systems and databases from different data sources can be challenging and require participation from various roles in your organization.

Even then, it is not sure what kind of results your attempt at discovery will produce, especially if you have opted for a manual or semi-automated approach. 

If you can’t account for your data, you can’t manage it and certainly can’t protect it, risking data breaches and steep compliance fines.

So discovering where your personal data is located is a crucial first step toward compliance.

DPM Data discovery solution automates the entire process and enables organizations to discover personal data from both structured and unstructured sources in any language and any script, as well as uncover dark data and shadow processing.

2. Classify Personal Data

The next stage, which follows the data discovery process, is data classification. Data classification is a process of analyzing and organizing data from different sources and categorizing it based on data type, data category, or sensitivity of the data.

The data classification process marks data and labels it with different tags that allow you to automatically categorize them in different silos according to data category.

Innovative data discovery solutions, like DPM Data Discovery,  can automatically classify all personal data throughout your organization, allowing you to build up-to-date records of processing activities, define different data categories, and classify sensitive personal data, but also enforce appropriate technical and organizational measures for each specific data set.

3. Manage Personal Data

The main goal of the data discovery process is to find, classify, and finally manage personal data.

Data classification gives you the information necessary to manage your data, apply policies, conduct data protection impact assessment (DPIA), and prioritize your data protection and risk mitigation activities.

Although DPM Data Discovery is independent of privacy software in use, when combined with the information from the DPM platform, users can have informed insight into the actual data processing in the organization.

DPM users can analyze and visualize findings in the dashboard by combining information about the scanned system’s hosting location, technical and organizational security measures, assigned processing activities, and other information.

How can DPM Data Discovery help you advance your privacy program

DPM Data Discovery is a powerful privacy-centric solution that allows you to identify personal data from different sources across all your IT systems using machine learning algorithms. 

Why is this important? To comply with privacy regulations and manage personal data in line with the GDPR, you must account for every personal dataset you hold.

You will need to know where you keep personal data, for how long, for which purpose, and who has access to it to apply appropriate technical and organizational measures.

• Language-agnostic and script-agnostic to cover all your markets no matter the language or the script in use
• Discovers personal data from structured and unstructured sources
• Connects to all standard databases
• No third parties, no personal data in the cloud
• Automatically searches for personal data
• Uncovers dark data and shadow processing
• Independent of privacy software in use