IDC MarketScape: Worldwide Data Privacy Compliance Software 2023 Vendor Assessment

IDC OPINION

This IDC MarketScape covers major vendors participating in the worldwide data privacy compliance software market. This vendor evaluation is based on a comprehensive criterion expected to be most conducive to success in providing tools to enable data mapping, data flows, data subject access request (DSAR) management, data privacy impact assessment management, and more to support enterprises both in the short term and long term. The evaluation criteria emphasize capabilities and strategies such as remote automation, personally identifiable information (PII) detection, and customized workflows. IDC expects critical success factors for data privacy compliance tools to be:

• Automated data discovery and classification capabilities to limit the manual lift and time generally associated with these processes
• Dynamic consent management that permeates through organizational infrastructure beyond cookie banners
• Deep regulatory library to monitor regulatory change across the many complex regulations across all global jurisdictions
• Advanced artificial intelligence (AI)/machine learning (ML) capabilities to analyze and provide additional value for clients across their privacy operations activities
• Global footprint to enable compliance with data sovereignty requirements of the various privacy regulations
• Strong focus on cybersecurity capabilities to ensure that client data is protected and secured

IDC MARKETSCAPE VENDOR INCLUSION CRITERIA

The inclusion criteria for this IDC MarketScape required to be actively selling software and have at least $10 million in yearly revenue related specifically to selling software designed to enable and facilitate compliance with data privacy obligations.

ADVICE FOR TECHNOLOGY BUYERS

The privacy market has drastically matured since 2018 when it first rose in popularity due to the implementation of European Union's (EU's) GDPR. The first iteration of privacy compliance platforms quickly grew their businesses with simple workflow and regulatory change capabilities. However, privacy buyers are significantly more sophisticated five years later and now expect deep integrations into their corporate data spheres. For the first five years of GDPR, much of the fear and doubt surrounding data privacy compliance has been surrounding data subject access requests. DSARs have become somewhat of a low-hanging fruit. The fear comes from the tight turnaround required under CCPA and GDPR and, likely, the direct interface with data subjects. The enforcement actions that regulatory bodies have completed have not focused on DSARs. It may be worth evaluating data privacy vendors on their other competencies.

In fact, consent management is a much more challenging aspect of data privacy compliance, one that has been responsible for massive fines. Sephora received the first CCPA fine for failure to manage consent. Meta was fined $414 million for European consent violations. Respondents to IDC's December 2022 Data Privacy Survey listed consent management as the biggest pain point of data privacy compliance. Evaluation of vendors should be sure to highlight consent management capabilities. Consent management needs to be dynamic and capture consent decisions across a variety of inputs.

At the end of the day, data privacy compliance is still a data governance problem. Data governance is taking center stage in data privacy and security strategies. By and large, traditional data governance vendors focus on structured data. Privacy regulations mainly impact unstructured data. Instead, organizations are leveraging data discovery and classification solutions to better understand compliance and risks to their data estates. Creating an accurate understanding of an enterprise's data estate is an essential foundation for privacy compliance. Buyers need to look for a data privacy vendor that has deep integration with a leading data discovery vendor or the data privacy vendor needs to have those capabilities itself.

VENDOR SUMMARY PROFILES

This section briefly explains IDC's key observations resulting in a vendor's position in the IDC MarketScape. While every vendor is evaluated against each of the criteria outlined in the Appendix, the description here provides a summary of each vendor's strengths and challenges.

DataGrail

DataGrail is positioned in the Leaders category in this 2023 IDC MarketScape for worldwide data privacy compliance software. DataGrail is a fast-growing data privacy platform company based out of San Francisco, California. DataGrail has a global presence with resources and customers across North America and Europe. DataGrail is focused on engendering enterprise trust and reducing risk through its data privacy solution. DataGrail has developed its compliance tool with a focus on integrations and automation.

DataGrail not only integrates with prebuilt connectors but also directly integrates with several hosted or on-premises databases. DataGrail started with a data discovery core but has since organically built out a complete privacy platform with still more major features set to debut. DataGrail touts its privacy dashboard as a single source of truth to bring together stakeholders across IT, legal, and compliance. DataGrail gives organizations real-time data monitoring to limit privacy risks. DataGrail's customer list ranges across industries and is a testament to the company's capabilities.

Strengths

• Privacy by design principles: DataGrail integrates deep into the organization, and customers note that its privacy capabilities weave deep into the fabric of customer organizations and enable privacy by design. DataGrail enhances efficiencies for its customers to create proactive privacy compliance. Users report this is supported by the ease of use of the program and how easily DataGrail can automate things like DSAR compliance. Marketo focused customers noted the ability to manage customer privacy from a proactive stance.