DLP And Regulatory Compliance

DLP and Regulatory compliance sounds like a checkbox of yet another task but dig a little deeper to remember where these laws come from. Data protection regulations for individual citizens, for example, come from a long-awaited realization of human rights that each government decides to recognize and protect. With the sheer volume of data that is collected, created, and transformed in a globally connected world, protecting data is no ordinary feat. Technology in the form of data loss prevention (DLP) rises to help fulfill this task.

What DLP is and how it came to be

The main function of DLP is to identify and prevent the unauthorized exposure or transfer of sensitive data. “Sensitive data” is defined by both the organization that’s deploying DLP and the governments whose rules and regulations the organization must abide by.

When the internet was still young and network data was all in clear text, the strategies of early data loss prevention focused on keeping sensitive data off the network and monitoring the network for keywords or phrases. As the internet evolved and security rose to the forefront to protect organizational interests (both public and private), DLP evolved as well. Proactively scanning content, integrating with the cloud, tracking user behavior, and moving to track the history of data—all are techniques of modern-day DLP. Depending on the business needs and working environments of an organization, a DLP or a combination of DLP solutions can both reduce the likelihood of data breaches and meet regulatory compliance.

Protecting The Right to be Forgotten

If your organization (or part of your organization) is established in the European Union (EU), or if your organization is outside of the EU and is processing data on individuals in the EU (for selling goods and services, or monitoring behavior in the EU), the General Data Protection Regulation (GDPR) applies to you. Effective 2018, GPDR protects any personal data of an individual, including identifiers that can reference a person indirectly (e.g., name, credit card number, IP addresses). GDPR believes in several rights of its citizens: (1) the right to access their data, (2) the right to be forgotten, and (3) the right to be informed.

DLP plays a role in GDPR compliance by identifying and classifying this personal data across an organization, and by enforcing policies to ensure personal data doesn’t get exposed or misused for purposes other than what was intended when collected. When the need for personal data no longer applies (or an individual exercises the right to be forgotten), organizations can identify the data with DLP and delete it in a timely manner.

Preventing Discrimination Based on Medical Condition

If your organization is a United States (US) healthcare provider, health plan, healthcare clearinghouse, or business associate of the above, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) applies to you. HIPAA designates how protected health information (PHI) can be secured and shared (i.e., for medical reasons), and the rights of individuals including accessing, requesting, and restricting their PHI. Before HIPAA, individuals’ PHI was distributed without permission to a lender, employer, or other third party for non-medical reasons, resulting in individuals being denied new health insurance, a job, and a mortgage, based on their pre-existing medical conditions. HIPAA protects the PHI of individuals to its intended purpose for medical reasons alone.

DLP supports HIPAA requirements by detecting PHI (especially in the age of mandated electronic health records) and providing ways for administrators to restrict PHI usage to only the intended, such as for health care reimbursement and not in an employment application. As PHI moves between various parties such as healthcare providers and insurance providers, this activity can be monitored and alerted on as it complies (or doesn’t) with policy.

Securing Financial Transactions Around The World

If your organization is located anywhere in the world and stores, processes, or transmits cardholder data, the Payment Card Industry Data Security Standard (PCI DSS) applies to you. PCI DSS was established in 2004 by American Express, Discover, JCB, Mastercard, and Visa to protect cardholder data and reduce fraud. This standard requires encryption of cardholder data on open networks and restricted access to this data—both physically and logically through authentication. PCI DSS makes secure digital payments possible on a global scale.

DLP can identify cardholder data through content scanning; well-structured formats like credit card numbers lend themselves well to this function. In addition to monitoring where cardholder data goes, DLP can fulfill encryption requirements for the data activity at rest and in transit.

DLP for Regulatory Compliance

Complying with data protection regulations means operating a business both legally and ethically. Doing business in today’s world means working with data as currency, and the responsibility of the business is to protect that currency at both an individual and organizational level. With data loss prevention, you can fulfill an important part of that equation by securing the regulated data and committing to only its intended use.