The GDPR came into effect in May of 2018, covering the United Kingdom and Europe with the world’s most stringent data protection regulation. The enforcement of GDPR comes in response to a series of high profile misuses of private data by global companies. Consumers need more autonomy over the huge data sets of their private information that businesses store and manage worldwide, and the GDPR is a step forward for consumer rights.
Control is your greatest asset
Data leaks are rife in today’s digital world – the way in which organisations store, manage and dispose of their sensitive data leaves many open to breach, which can be catastrophic for business. Poor asset management is a common blunder leaving businesses open to attack – this includes a lack of control over what assets the organisation actually has, and a lack of visibility of the huge amounts of data which are no longer business-critical but are still being stored and processed.
While many companies fall short in the management of their assets during the IT asset lifecycle, it’s the decommissioning of these assets where many businesses fall short. If IT assets are not completely sanitised and data left completely unrecoverable, sensitive information can just walk out of the premises with the assets. If that data lands into nefarious hands, the cost to your business in reputation, loss of custom, and now fines will be huge.
On request
Thanks to GDPR, consumers have the right to erasure, meaning they can request a business disposes of their information. To be GDPR compliant businesses must therefore have a data erasure policy. Modern-day compliance requirements are pushing businesses towards more professional approaches to data management and disposal, as well as IT asset management, to avoid costly data breaches. The International Organisation for Standardisation (ISO) highlights data sanitisation as a foundational practice when asset decommissioning. Here are further recommendations to keep compliant:
The spotlight on data protection and management is causing a shift in global enterprise
First off, it’s crucial that businesses have stringent processes in place to document the IT assets they own. But including an asset decommissioning policy as part of an overall cybersecurity and information protection policy is also essential. Successful policies are those that convey exactly what’s onsite, in use, and decommissioned, and that strive for operational efficiency – making sure operational teams are not seeking any shortcuts. Once adopted, it’s important to implement policies in a controlled manner by reviewing audit trails.
Another option is to use secure external IT asset decommissioning services to process equipment at end of life. If this is a more viable solution, make sure to only use certified, reputable partners that give you full assurance, and which have their own stringent data sanitisation processes in place.
It is also imperative that no assets leave the premises, such as the data centre, without proper data destruction. Even raided drives still contain stripes of data that could create risk for your organisation. Secure data destruction according to best practice and policy saves on time and money when compared to manual processes, so now’s the time switch to secure data erasure to boost your organisation’s bottom line.
Compliance is key
The spotlight on data protection and management is causing a shift in global enterprise – the work being done by lawmakers and regulators worldwide is causing businesses to improve their data and asset management systems to prove readiness and compliance with the law, and to showcase their respect and care for their customers. Don’t be left behind, enact a stringent data management, processing and disposal policy that protects your customers – and your business – from a costly data breach.
Author: Fredrik Forslund
Original Source: The Stack
