Data Privacy

1. Data Flow Diagrams (DFDs) depict both protocols, trust boundaries, inherent security controls, and data classification types for data. DFDs reside with technologists so that they can understand the direction in which PII flows in/out of IT environments. This plays a key role when having to address security controls referenced by various privacy laws like HIPAA, PIPEDA, and GDPR, as well as privacy frameworks such as the Asia-Pacific Economic Cooperation’s Privacy Framework, as well as the Cross-Border Privacy Rules.

2. Data Discovery Reports focus on illustrating where PII a targeted mapping of PII data stores and transportation mediums across Client infrastructure, as well as prescriptive advice for privacy gaps identified. This is extremely important for ongoing data management efforts and becomes a ‘living’ artifact for both IT and privacy professionals alike.

3. Privacy Impact/Threshold Assessments are non-technical assessments performed to identify the systems, applications, and data stores (also known as systems of record) that house PII. They complement more technical data discovery efforts from VerSprite’s previously mentioned eDiscovery efforts. VerSprite leverages NIST SP 800-122 to provide a framework for discovering which systems may be sharing PII and if proper authorization of such data shares is in place. This determination leads to the impact analysis of PII sharing amongst and beyond the corporate IT environments. Relevant privacy laws are mapped as part of the PIA piece of this process to identify impacts associated with previously identified data flows.

Data Classification:

Our review of data classification policies and how they are technically applied to information environments helps clients see how and where security controls should be applied in conformance to privacy requirements as data importers or data processors.

Data Retention Policy Reviews:

Data retention can extend an organization’s liability and overall data risk. Many organizations don’t have proper retention periods defined and can mistakenly make data too available for both internal and external factors. Without a true business need to have data available or even retained, companies can run the risk of becoming liable for its safeguarding and privacy. VerSprite evaluates data retention policies and practices by leveraging some of its data discovery services and then mapping the source of PII to retention policies applied by client organizations to those PII records.

Data and Privacy: Legal & Regulatory Compliance Readiness

Privacy laws have been exercised to affect many companies that violate the authorization, use, and security of PII data. Many of those laws, particularly with GDPR, provide many challenges to MNCs who may not know where PII is housed or what controls they have to ensure its proper safeguarding. VerSprite services for legal and compliance readiness around privacy laws extend to include the following:

Data Privacy Shield & Privacy Program Reviews

Many organizations do not have a formal data privacy program that defines both an internal and external policy around how PII is being managed. VerSprite not only reviews or helps develop appropriate policies around the nature and use of PII, but also reviews whether companies’ privacy programs have adequately prepared for or properly adhered to global privacy frameworks such as the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks. Considerations around the scope of PII (under management), data flows, exposure levels, and ongoing changes in acceptance from legal courts all factor in VerSprite’s privacy program reviews and guidance services. VerSprite reviews the precedence of legal cases (at various levels: state, federal, international) to establish strategies tailored to clients of varying industries and data exposure levels.

Legal Contractual Reviews

Sampling of vendor contracts and client MSA agreements help to determine the level of regulatory risks assumed by VerSprite clients or whether legal risk transferences are possible. VerSprite works with a partner legal firm (well-versed in international privacy laws) in order to provide a joint effort around privacy considerations for vendor and client contracts.

• Model Clauses & MSAs: VerSprite’s analysis helps to determine if risk acceptance of MSA terms may be over-arching to the services being provided by the client organization.
• Security Clause Review & Gap Analysis: VerSprite helps to identify whether or not depicted security controls or security assurances can/ cannot be fulfilled by the client. Many of these exercises pertain to contractual clauses found in EU’s Model Clauses and HIPAA’s Business Associate Agreements as an example.