Henrik Bornhede: 5 Things Businesses Should Know About Protecting Customer Information
By: Henrik Bornhede
Tags: Information Security, Infosec, Henrik Bornhede, Customer Information

As concerns over data privacy, data integrity, and transparency rise, it’s becoming more important than ever for businesses to take data protection seriously. According to Salesforce research, 73% of consumers today agree that trust in their favorite companies matters more than it did in years past. People today not only want but expect companies to process and use their personal data without violating their privacy. What’s more, getting data privacy right can be a great way to maintain your company’s reputation and ensure resiliency in the long term.

When it comes to protecting your customers’ personal information, having the right strategy and protocols in place is key. To ensure compliance, every business’s approach should be built on the three pillars of data protection :

100% complete and transparent compliance with data privacy law Ensuring the proper data protection strategy for processing personal data such as collecting, rectifying, erasing, and exporting data. Upholding the right of an individual to have control over their personal data.

Building the right approach for your company requires more than simply understanding these three elements, however. As you work to create your data protection strategy, it’s important to keep these tips in mind.

Do a risk assessment

Before implementing anything, perform a risk assessment. It’s entirely possible that the technical and organizational measures you have in mind aren’t 100% sufficient if you don’t know the risk. Making sure you have all your ducks in a row is the best way to ensure your approach is bullet-proof. Implement control measures based on risk analysis, or you’ll risk a potential breach and massive decline in customer trust.

Communicate clearly with departments

In tandem with performing a rigorous risk assessment, those heading data privacy strategy should communicate early and often with specific departments on what that strategy will mean for them. Your data privacy rules will mean different things for your customer service department vs. your marketing team. Taking the time to intentionally sit down and discuss these nuances will help give your teams a better understanding of their role within the plan, and will give them the opportunity to ask questions and make sure your rules are appropriate for their department.

Look for technical solutions

Striking the right balance between too much and too little is key. Implement too many organizational controls and you’ll inadvertently create too much overhead. This can lead to people not following through with protocols or ignoring them completely. When possible, look for technical solutions that can replace human intervention. These solutions can help take the burden off your teams and ensure a smooth process flow.

For example, many companies have made the decision to install VPNs (virtual private networks) onto every employee’s computer, instead of creating more rules to circumvent the risk of employees who don’t have a VPN. Take the time to find the right technical solutions for your business’s unique needs.

Optimize your documentation practices

Following best documentation practices can save your organization a lot of time and energy. And in the case of a problem, can help provide a detailed record of what went wrong where. Nowadays, it’s not enough to assume that everyone knows and understands processes and procedures. Everything should be backed up, even the paperwork.

It’s also a good idea to invest in technical solutions to make saving information easier. For example, some software can help teams locate documents without having to remember where they were saved. The more you can reduce the human margin of error, the better.

Implement special protections for certain customers

In certain situations, customers may need extra protection, and your business will need to be able to provide customized privacy measures. When these situations arise, organizations should implement specific technical controls to provide the protection needed.

About Henrik Bornhede

with a Master’s degree in computer science and cybersecurity from Stockholm University. His years of experience in information security make him especially qualified to consult businesses in a variety of industries on data privacy and Henrik Bornhede is an information security consultant cybersecurity issues. When not consulting clients on all matters infosec, he enjoys playing chess and listening to music.