All companies collect and process a lot of personal data and sensitive data. If you are responsible for GDPR (General Data Protection Regulation) it can be a pain in the ass to get a clear overview of where you store all the data, your company has collected. But getting this overview is the first step to protecting the data. It starts with data discovery, which is the task of mapping out all your data. In this post, we will tell you what data discovery is and how you can get started.
What is data discovery
Every business collects enormous amounts of data on their customers, markets, production process, and any other process in the customer journey you can think of. As a result of this, it can be difficult to identify where personal and sensitive data are stored in your business. It makes it difficult to know where you need to take extra precautions when handling and processing the data. This is where data discovery comes in. Data discovery involves scanning your files, emails, and systems to find where your data is stored across your business and who has access to it. Data discovery allows you to identify, track and classify sensitive data and gain visibility. This helps you to get an overview that will help you protect your data by making sure appropriate controls are in place and you are meeting compliance requirements. Doing this manually can be a dreaded task. Luckily, there are different solutions out there such as Safe Online who offers tools that can help you map your sensitive data. We’ll get back to them later.
Why is data discovery important for data compliance
Data that is hiding somewhere on your servers cannot be effectively managed or protected and as a result, it can be subject to data breaches. You might have personal data across your systems for different purposes that might no longer exist. Unused and hidden data might seem harmless, but the same GDPR rules apply and therefore it’s important that you take steps to detect all types of sensitive data from systems regardless of its usefulness because you need to protect and respect customers’ privacy. Non-compliance can be financially devastating for companies, which is why it's important that you know what data you process and where you store it. You need a strategy to make this happen such as data discovery to guarantee around-the-clock compliance.
Remote working and the need for data discovery
With remote work being the new normal in many businesses, at least partially, daily business activities like file sharing and storage are carried out in the cloud. This can become a challenge because you need to know precisely where important personal data is stored. To make this even more difficult, data is constantly changing and moving, regulations are evolving, and you are probably also implementing new technologies and systems now and then. As a result, it can be difficult to find the time, resources, and even expertise, to keep track of where personal data is stored. Data discovery is a solution that can help you map out your data and take measures to have the best security practices in place. You need an overview of all your data before you can protect it properly.
What are the benefits of data discovery?
Data discovery has several benefits that can contribute to stronger data security in your company. Here are just a few of the top benefits effective data discovery can help you achieve:
- The ability to apply protective controls and protection policies to company data
- Enhancing the process of understanding the data you own, where it is stored, who can access it and where
- Tracking sensitive data that may be exposed or on the verge of a breach due to inadequate security
- Having complete data visibility
- Risk management and regulatory compliance
There are two ways of doing data discovery
The two forms of data discovery are manual and smart data discovery tools. Manual data discovery is the manual management of data by a technical data expert. Smart data discovery tools take advantage of automation to make the process quick and easy. Smart data discovery is more effective as not only is it quicker, but it is more cost-effective in the long run, as it is much less labor-intensive for you to conduct. Of course, you still need to keep an eye on the tool and make sure it finds all the data, but if it works, it saves you a lot of time. Companies need controls when it comes to data security and data discovery and data discovery tools are one thing to help with that.
How to get started with a data discovery tool?
The manual way sounds tiresome, right? Therefore, it makes sense if you want to get started with a Data Discovery tool. The first thing you need to do is to find someone who provides such a tool. Safe Online provides a Data Discovery solution. After you’ve found a tool, it takes 3 steps to get started and a fourth step to keep going.
Step 1: Scan your files and emails
First, you use the tool to map out and find all your sensitive data by scanning folders, files, and e-mails. If you are not using a tool, check all the folders and files manually while documenting it. You cannot do anything before you have a status on where you are today. You need to choose what to scan and then sit back and wait for the results (if you do it manually, there’s no sitting back and waiting).
Step 2: Get an overview of your sensitive data
After scanning your files and emails you will get an overview of all your sensitive data and where you store it. Hopefully, there’s not too many surprises but we imagine there might be a few the first time you do a scan. The overview of data is important as it will also be your baseline for how you are doing today and be the starting point for taking some decisions on what to change or not. Safe Online also provides you with statistics showing the risk of the data you store. This makes it easier to do a thorough risk analysis that will help your data protection work.
Step 3: Take actions
Based on the overview, it’s time to act. You might find out that employees don’t delete their emails and that you store a lot of personal data in emails. If this is the case, then this is an obvious challenge you need to address. You might also find files that you didn’t know had a lot of sensitive data in them and therefore the files are accessible to all employees. And an easy fix is to save the files in a place where only the right people can access them.
Step 4: Repeat it
Data discovery is not a one-time fix. New data is being stored all the time and by scanning your files and emails continuously you make sure that you keep track of it. Hopefully, the scanning and statistics can help you build processes that make sure that all data is safe and sound, but you need data mapping to make sure this is the case.
It’s all about protecting data and avoiding fines
You must know what data you process and where you store it before you can protect and handle it in an effective way. Data discovery and mapping your data is the first step towards doing this. You can do it manually by going through all your company data, but it is a tiresome process. You can also use tools such as Safe Online’s DataMapper, to make it a bit easier. When you have a clear overview of all your stored sensitive data you can take actions to make your data processing better and more secure. In that way, your customers will trust you and you will avoid fines because you have a clear overview of what data you are processing and how. It's a good step in the process of being GDPR compliant.
