Report Details – Privacy Buyers Guide (Landing Page) | DataGrail

Understanding Data Privacy Solutions

You’ve determined that you’re subject to CCPA, CPRA and/or GDPR, and now you need to figure out if there is a data privacy solution that can help handle your privacy program.

You’re not alone. Millions of companies are asking the same question. Designing a privacy program that instills the necessary transparency to build trust with your customers isn’t always easy, but with the right partner, it can be done well.

This guide is designed to help you choose a privacy solution that is best for your company. After speaking with dozens of privacy professionals, we found accuracy, ease of ongoing maintenance, and automation rose to the top as the most beneficial, which is why you’ll see these attributes highlighted in the requirements below.

A privacy solution is the backbone of your privacy program, and the right one should enable you to automate elements of your program, and help you fulfill requirements to become (and remain) compliant with CCPA, CPRA, GDPR, LGPD, and upcoming regulations. And, as we just saw with the passing of CPRA (otherwise known as CCPA 2.0), the laws change frequently, so a solution that will scale and evolve as regulations do is critical.

Requirements for a Data Privacy Solution

The top five requirements you should consider when evaluating a data privacy solution for your business include (remember the acronym DMAAP, like "Data Map"):

1. Detect
2. Map
3. Automate
4. Authenticate
5. Partner

1. Detect

Enumerates unknown systems containing personal data in your organization

Organizations store personal information everywhere — on locally owned databases, in cloud-based servers, in SaaS solutions (e.g. Salesforce, Snowflake, Slack, Shopify, Zendesk, Zoom, etc.), and throughout their supply chain.

A privacy program is only as good as the source of the data, so the first step for building your privacy program is to locate where all the personal data lives in your organization. Most modern companies don’t know where all the personal data is stored on an individual.

When evaluating a privacy solution, it’s critical to understand how it identifies and takes inventory of all the places data is stored at an organization. Some solutions rely on you — the customer — to detect all the sources of data. Other solutions can detect new places where personal information is stored and data platforms that are unknown to you (also known as shadow IT).

This is critical to complying with many elements of the new privacy regulations, including:

• Records of Processing Activity (RoPA)
• Data protection impact assessment (DPIA)
• Data subject access request (DSAR) completion

Questions to ask a potential vendor

1. How does your solution find and take inventory of all the data platforms that may contain personal data?
2. Can the solution surface shadow IT that may contain personal data?
3. How does the product detect new internal systems or applications that contain personal data?

2. Map

Discovers and maps personal data within your organization’s systems

Once you’ve found all the applications, databases, systems, etc. that contain personal data, the next task is to connect and discover data within those systems so you can map and classify that data in such a way that it’s usable for your privacy program.

The ideal privacy solution should connect directly with your data sources so it can be updated in real-time to create a data map — a living blueprint of all the data in your organization.

Questions to ask a potential vendor

1. What types of data platforms and sources does the solution connect with?
2. Can the solution handle unstructured data?
3. How does the solution integrate with a data platform to perform data mapping?
4. How frequently is the data map updated?
5. How does the solution detect changes in data platforms (e.g. field changes, new applications, new administrators, etc.)?

3. Automate

Automate privacy workflows and processes

Good privacy solutions automate repeatable processes and allow for organizations to add the appropriate controls and escalations. They are also designed to scale and easily add new functionality as new regulations emerge or existing regulations change.

Questions to ask a potential vendor

1. On average, how many people on my team will be involved with completing a single DSAR?
2. Do I need to fill out spreadsheets or workflows to complete a DSAR?
3. Is there a human in-the-loop from the solution for any automation? If so, how does that work in practice?
4. How does the solution complete Do-Not-Sell requests?
5. How does the solution support creating a RoPA?

4. Authenticate

Verifies an identity without requiring additional personal information

To avoid upsetting your customers, find a privacy solution that uses existing personal information associated with a person’s record, such as purchase history or user behavior to securely validate the individual’s identity.

Questions to ask a potential vendor

1. How does the solution meet the CCPA’s three-step identity verification requirements?
2. How does the solution handle authorized agents?
3. What additional personal information is required to verify a DSAR?

5. Partner

Offers a dedicated privacy partner to ensure ongoing success

Privacy is a journey, not a destination. You need a partner who’s going to help you every step of the way as you navigate a new regulatory space that’s emerging.

Questions to ask a potential vendor

1. Can you provide 3+ enterprise references with your product?
2. How long will it take to set up my data inventory and data discovery?
3. What customer support is included in the base fees? Are there professional services?

Conclusion

Choosing a privacy solution for your company should take into account your company size, number of anticipated DSARs and how big your privacy team is.

Most organizations want one privacy solution that can manage their entire privacy program, and privacy solutions that prioritize accuracy, create efficiencies, and automate tend to help organizations by doing two things:

1. Increase trust in your brand by ensuring transparency
2. Reduce the risk of being fined

Your privacy solution should promise easy ongoing maintenance. Privacy is organic and forever-changing. In turn, you need a solution that can scale and a partner who is with you the entire way to guide you through future changes you might need to make.

Questions to answer about your organization

1. How many internal resources can you dedicate to privacy?
2. Do you have anyone working on privacy? If so, how many people?
3. How many internal IT resources can you dedicate to privacy?

If you have limited resources, you’re likely on the hunt for a solution that can “check the boxes” on privacy compliance. Larger organizations are more likely to have dedicated privacy teams and are searching for a one-stop-shop privacy solution.