More Data, More Problems - Debbie Reynolds “The Data Diva”

Data is the lifeblood of organizations, but managing personal information brings varying degrees of Data Privacy risks, some of which are blindspots to organizations that may think they are on solid ground in their Data Privacy maturity. 

As the stakes continue to rise with more data being created, collected, and stored, an astronomical increase in cybersecurity data breaches and unauthorized access, more regulatory scrutiny around handling personal data, and rising consumer expectations around organizations protecting their data, it is key that organizations realize that even the most savvy of organizations have Data Privacy blindspots. 

While many organizations tout robust Data Privacy policies and procedures, their Data Privacy blindspots pose significant risks. These blindspots often involve unseen, overlooked, or inadequately assessed data risks, leading to potentially substantial vulnerabilities. Among the most common yet dangerous blindspots are inadequate consideration of unstructured data risks, data duplication risks, and how organizations manage legacy data. This essay explores these Data Privacy blindspot risks and provides strategies for identifying and overcoming them to enhance your organization’s Data Privacy and cybersecurity posture.

#1 - Unstructured Data: The Sleeping Giant Data Privacy Risk Blindspot

When I advise organizations who feel confident about their data governance and Data Privacy maturity, they sometimes show me evidence of all their applications in data maps or records of processing activities and how data is managed in those systems. This is a great starting point; however, according to a 2023 IDC report, “Untapped Value: What Every Executive Needs to Know About Unstructured Data”, up to 90% of data created in organizations in 2022 was unstructured, which is often not sufficiently mapped of analyzed for Data Privacy risks.  It is estimated that 70 to 80 percent of all data organizations hold is unstructured. 

Unstructured data, which includes Word documents, PDFs, images, videos, spreadsheets, presentations, chat logs, etc., on servers, file shares, and computers, are a huge blindspot and Data Privacy risk. The sheer volume of these data lakes alone can be daunting to address as they will continue to grow exponentially. Even if organizations manage this data via access controls and organize it in folders, these data lakes are often not sufficiently classified for their underlying Data Privacy risks. 

Unlike structured data, which is neatly organized in databases or systems and easier to control, search, and manage, Unstructured data is inherently chaotic. Unstructured data is “data without a story” because it lives outside of a structured system and lacks the context of the data’s origin, stewardship, purpose, provenance, lineage, or point of reference for how it ended up in a data lake. This makes it more difficult to categorize, analyze, or secure.

The Data Privacy Blindspot Risks of Unstructured Data

One of the main risks associated with unstructured data is that it frequently contains personal or sensitive information that may not be adequately recognized, categorized, or protected. For example, documents containing personal information (PI), personally identifiable information (PII), or confidential business information not adequately categorized or properly secured based on their content become a Data Privacy and business risk. Because unstructured data is often spread across multiple locations—such as cloud storage, file servers, and personal devices—tracking and managing this data becomes a formidable challenge.

Also, unstructured data tends to grow exponentially. As employees generate more content, this data is often orphaned from its place of creation and officially protected confines, making it even harder to monitor for data risks or to locate when action is needed when complying with regulations that mandate individual rights to data correction, data deletion, or the right to be forgotten. 

The more unstructured data there is, the greater the risk of data breaches through malicious attacks or accidental leaks.

Overcoming the Data Privacy Blindspot of Unstructured Data

To manage the risks associated with unstructured data, organizations must take a comprehensive approach that includes several key strategies. Here’s a list of actions companies can take to overcome these risks:

Gain Visibility Through Data Mapping - Conduct a comprehensive data mapping exercise to identify all the locations where unstructured data resides within the organization. This will help you understand the scope of your unstructured data and where potential risks may lie.

Establish Document Classification Practices - Develop and implement standardized practices for administrators and employees to classify documents accurately. This ensures that all data, especially those with privacy risks, are appropriately handled and secured.

Adopt Privacy-Enhancing Technologies (PETs) - Implement tools and methodologies to classify and categorize unstructured data based on its content and metadata. This includes identifying documents with potential Data Privacy risks, such as personal data (PI), personally identifiable information (PII), or sensitive business information.

Implement Strict Access Controls - Unfortunately, too much unstructured data lacks sufficient access controls and, in some cases, presents data without robust group or role-based protections. Adopt a need-to-know policy to limit access to unstructured data. This will ensure that only authorized personnel can access unstructured data, reducing the risk of unauthorized exposure.

#2 - Data Duplication: The Silent Data Privacy Risk Blindspot Multiplier

Data duplication occurs when copies of data are made across multiple systems and often end up in unstructured data lakes intentionally or unintentionally. While data duplication might seem harmless, it can create significant Data Privacy risks, especially if personal or sensitive data is duplicated and stored in less secure environments. Duplication can start when different departments use data in different systems while copies are made and changed along the way. As the data flows throughout the organization, copies are made. These copies often reside outside the protected “official systems,” which have the proper data controls.  As a result, organizations may have secure documents organized properly in their official systems, plus copies of that data that may float unprotected in the organization's unstructured data lakes.

The Data Privacy Blindspot Risks of Data Duplication

Data duplication's primary Data Privacy risk is that it multiplies the opportunities for data breaches and unauthorized access to data. Each duplicate copy of personal or sensitive data represents an additional point of vulnerability. For example, if personal or sensitive customer data is copied from a secure database to an employee’s personal devices or file shares, the security controls protecting that data may not be as robust, increasing the Data Privacy risk.

Data duplication also complicates compliance efforts. Data Privacy regulations often require organizations to know where personal data is stored and to ensure it is properly protected. If an organization is unaware of all the locations where personal or sensitive data is duplicated, it may inadvertently fail to comply with these regulations, leading to significant fines and reputational damage.

Duplicated data increases storage costs and makes data management more complex. With multiple copies of the same data floating around, it becomes more difficult to maintain data accuracy and integrity, leading to errors and inefficiencies in business operations.

Overcoming the Data Duplication Blind Spot

To effectively overcome the risks associated with data duplication, organizations should implement a comprehensive approach that includes the following strategies:

Establish Clear Data Governance Policies - Define where data should be stored and who can create and access copies. This includes creating strict guidelines about data duplication and storage practices to ensure consistency and security.

Educate and Train Employees - Ensure employees are aware of the risks of data duplication and are trained in best practices for data storage and management, including avoiding the storage of personal or sensitive customer data on personal devices, using only authorized and secure storage locations, and adhering to company protocols for handling and storing data securely.

Implement Data Deduplication Strategies - Identify and eliminate duplicate copies of data, ensuring that only a single master copy is retained and managed. This approach reduces storage costs, simplifies data management, and enhances security.

Utilize Automated Tools: Deploy data management systems configured to flag or block attempts to copy sensitive data

#3 - Legacy Data: The Often Forgotten Data Privacy Blindspot

Legacy data refers to older data that an organization retains. This data is often no longer actively used because of its declining business value but is still retained by the organization. Legacy data may have a lower business value but often has a high Data Privacy risk. Examples of risky legacy data include outdated customer records, old financial data, or obsolete business data. While this data may seem harmless, it can pose significant privacy and security risks if not properly managed.

The Data Privacy Risks of Legacy Data

One of the main risks associated with legacy data is that it is often forgotten or neglected, leading to inadequate protection. Legacy data may be stored on outdated systems that lack modern security features, making it an easy target for cyberattacks. Additionally, legacy data may not be subject to the same rigorous access controls as active data, increasing the risk of unauthorized access. A growing number of publicly reported data breaches are of legacy data.

Legacy data can also complicate compliance with Data Privacy regulations. For example, many Data Privacy and data protection regulations require organizations to delete personal or sensitive data that is no longer needed for the purposes for which it was initially collected. If an organization fails to properly manage its legacy data, it may inadvertently retain data that should have been suppressed, anonymized, or deleted, exposing the organization to regulatory penalties and potential consumer lawsuits.  This risk is all the more daunting as before the surge of Data Privacy and data protection regulations, organizations traditionally were not required to delete personal or sensitive data. Modern data systems are made to remember, not to “forget” data, which makes compliance with these new regulations even more challenging for organizations.

Legacy data can clutter an organization’s data environment, making managing and securing active data more difficult. The more data an organization has, the harder it becomes to maintain visibility and control over that data, increasing the risk of data breaches and unauthorized access.

Overcoming the Legacy Data Privacy Blind Spot

To effectively manage the risks associated with legacy data, organizations should take the following detailed steps:

Conduct a Comprehensive Data Audit - Thoroughly assess all data storage locations, including old servers, backup systems, and archived files, to identify legacy data. This step ensures that no outdated or forgotten data is left unaccounted for.

Evaluate and Take Action - After identifying legacy data, securely delete any data no longer needed using secure deletion methods. Protect necessary data by implementing strong encryption and access control measures to prevent unauthorized access.

Implement and Regularly Update Data Retention Policies - Establish clear policies that specify how long different data types should be retained and when they should be deleted. These policies should be regularly reviewed and updated to align with current Data Privacy regulations and organizational policies.

Ongoing Legacy Data Management - Regularly review your data environment to identify new instances of legacy data and ensure it is consistently managed according to the organization's retention policies and security protocols.

Data Privacy is critical for all organizations, but even the most well-prepared companies can fall victim to these Data Privacy blindspots. Unstructured data, data duplication, and legacy data are three common areas where organizations may unknowingly expose themselves to significant risks. By identifying and addressing these blindspots, organizations can strengthen their Data Privacy posture, reduce their risk of data breaches, and ensure compliance with Data Privacy regulations.

Implementing data mapping, deduplication, and regular audits can help organizations gain visibility into their data environment and proactively protect their sensitive information. As Data Privacy risks are increasingly common and costly, addressing these hidden risks is not just a best practice; minimizing these risks can make Data Privacy a business advantage.