When we talk about data protection, the General Data Protection Regulation (GDPR) comes to mind. This regulation introduced the prospect of heavy fines for those in breach - €20 million or 4% of annual revenue - but also marked a significant milestone in data privacy across all EU member states.

However, it feels as if GDPR and the date of May 25, 2018, were simply another Y2K – a momentary frenzy followed by a return to business as usual.

Nevertheless, data protection should not be regarded as a mere tick-box exercise for compliance. It has taken on a newfound importance as end users, your valuable customers, have become increasingly security conscious. At the same time, they have also become highly sought-after targets and easy prey for cybercriminals.

Sean Cohen

As organisations gather more and more data about their users, the stakes have been raised. The potential ramifications of data breaches and cyber threats can now lead to catastrophic outcomes. According to the US Securities and Exchange Commission, 60% of small companies that fall victim to a data breach never recover and are forced to shut their doors within a year.

The landscape of data protection has transformed, and businesses must adapt to ensure their survival and maintain the trust of their customers. Compliance with data protection regulations is no longer sufficient; organisations must proactively prioritise the security of their data and the privacy of their users.

The time has come for organisations to not only meet the minimum requirements of data protection but to also embrace it as a business imperative. By doing so, they can mitigate risks, improve customer trust, gain a competitive advantage, and establish a foundation for long-term sustainability.

The journey towards effective data protection involves technical implementation, management buy-in, the role of service providers, and the adoption of industry frameworks and standards.

Challenges in data protection

With the proliferation of data breaches and cyber threats, organisations must recognise the importance of safeguarding sensitive information. Data breaches can result in severe consequences, including financial loss, reputational damage, and legal implications. IBM reports that in 2022, the average total cost of data breaches was $4.35 million. Implementing effective data protection strategies comes with its own set of challenges. Understanding the industry, relevant frameworks, and operational scope is essential. Compliance with regulations poses complexities that require careful consideration.

Resilience can only be achieved through robust strategies that encompass the entire organisation and align with internationally recognised frameworks.

For businesses in their early stages of security implementation, it is essential to establish fundamental measures to protect against potential threats. These basics include encryption, endpoint protection, and multi-factor authentication to guard against identity and credential attacks. By establishing this security baseline, businesses can lay a foundation for future growth.

As the business expands and higher volume of data are being handled, it becomes necessary to adopt more advanced technologies. Data classification, vulnerability management, and incident response planning are examples of these advanced measures. Implementing these technologies will enable businesses to proactively prepare for and effectively respond to potential data breaches.

The role of management and C-level

Management buy-in and top-down leadership are crucial for successful data protection implementation. Boards should define policies, while middle management translates them into standards, guidelines, and procedures. IT and security professionals then execute the strategies based on these frameworks. A bottom-up approach leads to budget issues, fragmented security, and non-standard implementations, hindering overall effectiveness.

Management must prioritise cybersecurity at a budgetary level and allocate necessary resources.

Successful implementation is seen in organisations prioritising resilience. Regular risk assessments, employee training, incident response planning, monitoring, and continuous improvement ensure data protection.

Smaller businesses often struggle due to attitudes and budgets. However, outsourcing to service providers helps navigate data protection complexities. They provide expertise, specialised tools, and certifications, meeting requirements without a full team. Data protection is now critical for business resilience in the evolving cyber landscape. It’s time to prioritise it as a fundamental aspect of operations.

Sean Cohen is Head of Technical Operations, BMIT Technologies plc.