Navigating data protection and privacy regulations

Organizations are collecting and managing more data than ever before. As the use of technology expands across all business functions, the data surge only grows.

Governments and industries are continuously enacting and evolving data protection and privacy frameworks. Some are laws that come with hefty fines for non-compliance, others simply propose guidelines to follow. In any case, most of them share the same goal: encouraging organizations to follow best practices in the ways they collect, store, manage, and secure data.

While keeping up with all the data regulations can seem overwhelming, it doesn’t have to be. There’s a lot of overlap between various data protection regulations and guidelines. Find out how you can remain compliant with both new and existing regulations.

EBOOK

 

Summary of the top protection and privacy regulations

One big contributor to the overwhelm is that there are many different data protection and privacy regulations out there. Remembering all the acronyms and what they stand for is difficult enough. Knowing the details, requirements, and consequences of each adds to the complexity.

What’s crucial is understanding that they all share similar principles and requirements for data protection. In many ways, they are complementary to one another. Before we dive into the commonalities, let’s explore a few different regulations around the world:

General Data Protection Regulation

The General Data Protection Regulation (GDPR) is one of the most important data protection and privacy regulations in Europe. It governs how organizations collect, use, and share the personal data of European Union (EU) residents. The GDPR is well-known around the world, mainly because it applies internationally to all organizations handling data of EU residents, and it set a benchmark for non-compliance fines—up to 4% of annual revenue or 20 million euros, whichever is greater.

WHITE PAPER

 

Network and Information Systems Directive

The Network and Information Systems Directive (NIS2) is an expansion of a previous EU cybersecurity directive, NIS1. It ensures that all organizations that provide their services or carry out their activities within the EU, and are considered a part of essential infrastructure, adopt and maintain strict cybersecurity practices. It also touches on aspects such as perimeter security, building access, visitor management, and disaster recovery. You can assess your current system with this checklist.

WHITE PAPER

 

ISO 27001

ISO 27001 is the leading international standard for managing information security. It establishes a framework with specific requirements designed to help organizations effectively manage and secure information security risks. Though these ISO requirements are non-mandatory, many companies get certified to better manage risk and show business partners and customers that they take data security seriously. 

European Union Artificial Intelligence Act

The European Union Artificial Intelligence Act (EU AI Act) is a law that governs how AI systems must be developed and used. Its goal is to ensure that artificial intelligence systems present in the EU are safe, transparent, traceable, non-discriminatory, and environmentally sustainable. It applies different risk categories to AI applications and stipulates non-compliance penalties of up to 35 million euros or 7% of worldwide annual turnover.

More examples of data protection and privacy regulations around the world

• The Data Protection Act, United Kingdom
• Personal Information Protection and Electronic Documents Act (PIPEDA), Canada
• Bundesdatenschutzgesetz (BDSG), Germany
• Lei Geral de Proteção de Dados (LGPD), Brazil
• Federal Act on Data Protection (FADP), Switzerland
• California Privacy Rights Act (CPRA), California, USA
• Health Insurance Portability and Accountability Act (HIPAA), United States

BLOG

 

The fundamental principles of data protection regulations

Each law, regulation, or directive will typically have specific requirements that may or may not apply to your business and operations. However, if your organization is already proactively thinking about or investing in data protection and privacy practices, you’re likely on the right path to compliance.

Responsible organizations do the right thing. They understand the value and urgency of keeping all data in their possession secure – whether it’s their own or it belongs to their suppliers, partners, or customers. They are keen to conduct assessments, invest in tools, and implement processes that align with the core principles of data protection and privacy regulations. It’s not because they have to, but because they know it will uphold business continuity as well as partner and customer trust.

What are the core data protection principles underpinning most data regulations? Here’s a quick summary:

Permission to collect and use

You need to have the right permissions to collect and use data, aligned with a legitimate purpose or objective.

Limitation of storage and use

You must limit the data you keep and only use or store the data that is necessary to meet specific requirements or objectives.

Transparency and accuracy

You need to remain transparent about your data practices and ensure the information is accurate so that you can handle it properly.

Protection and security

You need to take adequate measures to protect and secure your data and ensure only persons who need to access the data can.

Individual rights

You need to respect individuals’ rights to their own data, including the rights to access, rectification, erasure, and others.

Accountability

You must take responsibility for your handling of the data, including having appropriate measures and records in place that show how you handle data and what you do to maintain data protection and privacy principles.

BOOKMARK IT

 

3 common misunderstandings about data regulations

Following best practices and knowing the ins and outs of data protection regulations are steps in the right direction. But even then, some confusion can still creep up. Questions such as ‘Is this a data protection law or guideline?’, ‘Does data need to reside in our country?’, or ‘Is this data requirement our responsibility?’ are some of the more common ones.

Understanding regulations versus directives and guidelines

There’s a lot of hype today about the latest NIS2 Directive. A few years ago, the same happened with the GDPR. In the next few years, there will likely be other new frameworks that will capture attention.

WEBINAR

 

While it’s critical to stay up-to-speed on what’s happening, you don’t need to buy into all the hype. This is particularly true if you’re already applying data security and privacy best practices and choosing trusted partners along the way. Taking a practical and comprehensive approach to protecting your data can go a long way in enabling you to be compliant.

Also, it’s important to keep in mind that not all frameworks are laws. For example, the GDPR is a regulation, which has binding legal force through all EU member states. On the other hand, NIS2 is a directive. This means it provides requirements that must be achieved but also necessitates member states to translate these obligations into national laws. Across member states, there may be differences in how NIS2 is implemented and enforced.

In fact, many national certification bodies across Europe such as ANSSI in France, BSI in Germany, GovPass in the UK, and Rijkspas in the Netherlands have adopted variations on the NIS2 requirements. Overall, these countries are following NIS2, but adapting it to their country differently. And while each encompasses comprehensive cybersecurity measures, there’s a distinct focus on certifying the robustness of physical access control systems.

Implementing a high assurance access control system with secure, supported I/O modules can help you comply with these strict European cybersecurity regulations. A high assurance access control system provides fully encrypted protocols and advanced cybersecurity capabilities from the credential and reader, to the controller and software. All of this enables secure door control, while ensuring sensitive information stays within the secured perimeter. That means you can reduce the risk of data interception or credential cloning.

PRODUCT

 

Lastly, there’s ISO 27001 which is a standard and certification. Though it’s not legally mandatory, compliance with ISO 27001 can help organizations meet various other regulations because the recommendations align well with those outlined in the GDPR, NIS2, and other similar directives.

Knowing this will help you better navigate expectations and requirements as new legislations or guidelines come out.

FREE GUIDE

 

The truth about data governance and geography

More organizations today are adopting cloud solutions or implementing hybrid-cloud deployments. When doing that, they question whether they need to keep data within their own countries to abide by regulations. Here’s the short answer: most data covered by data residency embargos and can, therefore, be legitimately exported to and handled in other countries, so long as certain privacy and security measures are put in place.

There are some exceptions to this. For example, certain types of data handled by the players in highly-regulated industries (like banking, government, and critical infrastructure) may, due to the sensitivity of their operations, be subject to data residency constraints. In other cases, certain organizations may simply have a preference or policy for keeping data within certain geographic boundaries, without that measure being legally mandated.

Personal data seems to be another big exception. In truth however, for most, there are no regulatory requirements for personal data residing within your country. What actually matters is whether the data is handled and protected in ways that meet applicable home-country regulations.

This is why working with a trusted vendor is critical. Informed and capable vendors should also be able to provide multiple options for data center locations to accommodate your needs and preferences, while also helping you to determine what’s best for your organization in light of any specific business and regulatory requirements

Knowing your roles and responsibilities

Across your supply chain, there are likely many different organizations with varying roles handling your data. While it is ultimately your choice to decide who gets access to what, the partners you choose also have responsibility in ensuring your data is properly managed and secured.

For instance, as the data controller, it’s your job to be diligent and vet the channel partners and vendors you work with. You must also confirm what data they have access to and how they intend to manage, store, and secure it. You’re also responsible for continuously evaluating their practices to ensure they are abiding by best practices and honoring their commitments.

But it’s not all on you. Those technology partners and vendors generally act as your data processors. That means they become accountable for technology deliverables and must remain transparent about how they will handle and protect your data. They must also take responsibility for any of their own actions (including that of their respective suppliers) that may impact your organization, or are misaligned with the commitments that they may make towards you

How the solutions you choose can make compliance easier

Not all physical security solutions on the market are built to support cybersecurity and privacy best practices. Some older, disparate systems weren’t designed to meet the various regulatory requirements and frameworks.

If ongoing compliance with these regulations is top of mind, choosing a unified physical security platform designed with cybersecurity and privacy in mind can help. Other factors such as deployment models and Responsible AI practices can help you advance toward your compliance goals.

Here’s how:

Built-in data protection and privacy tools

Physical security solutions built with cybersecurity and privacy in mind come with a host of tools that help you enhance resilience and keep data secure. Encryption, authorization, and authentication methods help protect your data and prevent it from falling into the wrong hands.

Advanced tools and services can alert you to potential vulnerabilities and simplify updates. Other features can allow you to restrict access and user privileges, and provide security scores to make sure you reach full-scale system resilience.

HUB

 

A unified physical security approach

A unified physical security platform aids you in implementing a single, global data protection and privacy strategy. Having one platform simplifies that process by helping you standardize your cybersecurity measures across all your physical security systems.

Using a unified platform, you won’t have to waste time checking different solutions to ensure cyber hygiene, track your system’s health status, or manage privacy controls. Instead, you’ll be able to manage all your security and related data protection and privacy settings for all your systems through a single interface.

EBOOK

 

Cloud and hybrid-cloud deployments

Cloud-based solutions take the burden of constant upkeep and hardening off your IT and security teams. Whether you have a cloud or hybrid-cloud deployment, you can remotely oversee system health checks and privacy controls from anywhere. You’ll also get higher levels of automation to ensure cyber resilience.

Opting for a physical security as a service (PSaaS) solution means you can get the latest versions and fixes automatically pushed to your system. You’ll also have access to the latest cybersecurity and privacy features as soon as they are available. This helps to ensure that your physical security systems are always up-to-date and protected against vulnerabilities.

PRODUCT

 

The importance of Responsible AI

Artificial intelligence (AI) can process a lot of data very quickly. Because of that, interest in AI has been growing in the physical security industry. Yet, if not handled responsibly, AI-based technologies can be developed or used in ways that intrude on privacy. Everything from biases and discrimination to skewed results and decisions are possible.

This is why there has been more regulatory focus on AI-driven innovations—and why every organization needs to be mindful of the solutions they choose and implement. Choosing vendors that prioritize Responsible AI is a must for those wanting to maintain regulatory compliance.

At Genetec, Responsible AI means ensuring our AI technologies are built with specific principles in mind:

• Privacy and data governance: Taking responsibility for how we use AI in the development of our solutions. Only using datasets that respect relevant data protection regulations. Keeping data protection and privacy top of mind in everything we do.
• Trustworthiness and safety: Considering ways to minimize bias and enhance accuracy in the development of AI models. Always striving to make AI outcomes explainable.
• Humans in the loop: Prioritizing human-centric decision-making and ensuring AI models can’t make critical decisions on their own.

BLOG

 

How to choose the right vendor to maintain regulatory compliance

Data is everywhere, there’s no getting around it. We’re living in a data-driven, connected world. And though new data protection and privacy regulations can seem overwhelming, they shouldn’t come as a shock.

Responsible organizations know that these regulatory frameworks and standards align with critical business practices. And that comes with a broader understanding of what compliance really entails: taking a pragmatic and comprehensive approach to data and privacy protection and partnering with trusted vendors.

BLOG

 

After all, ensuring compliance with evolving regulatory frameworks isn’t just about the technology you choose, but also about the people you partner with. And having partners on your side who value and prioritize compliance with these regulations matters.

They’ll have the resources, technology, legal knowledge, contracts, and partnerships that will help you maintain proper oversight, no matter how regulations evolve. They’ll also be able to provide a list of certifications from governing bodies and regulatory authorities for both their products and business operations. These certifications are critical in assessing a vendor’s commitment to compliance and data protection.