Understanding your organisations data

Digital Economy and Risk Alert

The cyber threat landscape is rapidly evolving. Minister for Cyber Security, Clare O’Neil, has warned that Australia faces a raft of national security challenges in coming years, including relentless cyberattacks. In the wake of recent high-profile data breaches, privacy is now front and centre, and cyber is a national security priority. 

Regulators have been quick to respond. Massive new penalties  for breaching the Privacy Act have been passed, which will further compound the often devastating impact of a cyberattack. Organisations need to actively prepare, and key to this is reviewing and assessing their data risk management practices and procedures. 

The stakes are high

In many cases, organisations are required to collect and retain data to comply with their legal obligations, but they must also keep that data secure. 

In responding to the raft of recent high-profile data breaches, the Australian Government has now passed legislation to introduce significant new penalties for serious or repeated privacy breaches. Maximum penalties may now reach whichever is the greater of A$50,000,000, three times the benefit of a contravention, or (where the benefit can't be determined) 30 per cent of domestic turnover. Changes to the Security of Critical Infrastructure Act in 2021 and 2022 bring comprehensive cyber risk management and notification obligations to critical infrastructure sectors. In 2023, the Attorney General is also reviewing modernisations of the Privacy Act, including a right for individuals to sue entities directly for privacy breaches and a right of erasure, also known as the 'right to be forgotten'.

An increased focus on Privacy: what can organisations do to mitigate their risk?

Organisations need to better understand the data that they hold and collect. They need to be actively considering when and why they are collecting personal or sensitive data, and be confident that collection of that data is in fact necessary. Organisations should also proactively assess how long data needs to be retained to ensure that data is not being held unnecessarily. Processes should be put in place to ensure any data that no longer needs to be held is destroyed, or at least de-identified. 

And if the worst comes to the worst, it is critical that an organisation can quickly and effectively respond in the event of a cyber incident or data breach (or both). Key to an effective response is the ability to immediately assess the scope of any data breach that might have occurred. The organisation needs a clear understanding of what personal or sensitive data has been collected, and where it is stored. It sounds simple, but in most cases it is not.

Undertaking a data risk review and developing a data governance framework are together the most effective way to ensure that an organisation is not only complying with its regulatory obligations, but is also well positioned to respond in the unfortunate event of a cyber incident or data breach.  

Getting started - 4 Key Steps 

Step 1: Implement a strong data governance framework

Organisations should review and standardise their data definitions, create data registers and inventories, and identify and operationalise data assets and data asset owners.
Any personal or sensitive information held by the organisation must be included in the governance framework. Data asset owners should be assigned for all personal data, sensitive data and highly sensitive data.

A strong data governance framework should include the following elements:

• Clear policies and procedures: Include clear policies and procedures for how data is collected, used, stored and shared, as well as for how data quality is maintained and how data breaches are handled.
• Accountability: Assign clear roles and responsibilities for data governance to specific individuals or teams within the organisation, and hold them accountable for ensuring compliance with the framework.
• Data classification: Include a system for classifying data based on its sensitivity and importance. This will help to determine how the data should be protected and managed.
• Data access controls: Include controls to ensure that only authorised individuals have access to data, and that data is accessed for authorised purposes only.
• Data quality: Include definitions of data quality, set thresholds and tolerances for acceptable standards based on data classifications, and outline processes for ensuring that data is accurate, complete and up to date.
• Data security: Include measures to protect data from unauthorised access, use or disclosure.
• Regular review and updating: Data should be reviewed and updated on a regular basis to ensure that it remains relevant and effective in the light of changing laws, regulations and business needs.

By including these elements, a strong data governance framework can help an organisation to protect its data assets and ensure compliance with relevant laws and regulations.

Step 2: Map and document end-to-end data flows

Organisations should record and visually map their data flows from the source of capture to the point of consumption.

This includes capturing all data from both structured and unstructured data sources, and documenting how that data has been transformed and why, while ensuring that technical transformations are accurate and align with their associated business rules.

Step 3: Identify and manage privacy risks

Most organisations do not have a holistic understanding of the data held by the organisation. Where does it reside? Does it contain any sensitive information?

Companies should record the purpose of processing the data; capture and manage customer consent; and ensure there is a lawful basis for the processing of all personal data across the organisation. Additionally, organisations will need to review and uplift their data retention standards and demonstrate compliance with the regulatory requirements.

Step 4: Assessing residual data risk across the organisation 

Without the right controls, processes and policies, data issues often go unnoticed until a material breach occurs. It is extremely important that organisations identify data risks across the organisation, assess the existing controls, identify control gaps, test the effectiveness of controls and periodically review the residual risk. Companies should also focus on standardising and rationalising the control environment in order to reduce the residual risk levels.

Understanding your organisation's data is key to mitigating cyber and data risk. The most effective way to approach this often complex exercise is to undertake a comprehensive review of the organisation's data, and then develop and implement a data governance framework. 

The heightened level of cyber risk, together with the increased regulatory focus on privacy and significant new penalties in force for privacy breaches, means organisations should begin to prepare now.