Privacy Management Solution Buyer's Guide

You’ve determined that you’re subject to CCPA, CPRA and/or GDPR, and now you need to figure out if there is a data privacy solution that can help handle your privacy program. You’re not alone. Millions of companies are asking the same question. Designing a privacy program that instils the necessary transparency to build trust with your customers isn’t always easy, but with the right partner, it can be done well.

This guide is designed to help you choose a privacy solution that is best for your company. After speaking with dozens of privacy professionals, we found accuracy, ease of ongoing maintenance, and automation rose to the top as the most beneficial, which is why you’ll see these attributes highlighted in the requirements below.

A privacy solution is the backbone of your privacy program, and the right one should enable you to automate elements of your program, and help you fulfill requirements to become (and remain) compliant with CCPA, CPRA, GDPR, LGPD, and upcoming regulations. And, as we just saw with the passing of CPRA (otherwise known as CCPA 2.0), the laws change frequently, so a solution that will scale and evolve as regulations do is critical.

The top five requirements you should consider when evaluating a data privacy solution for your business include (remember the acronym DMAAP, like ‘Data Map’):

1. Detect
Enumerates unknown systems containing personal data in your organization
2. Map
Discovers and maps personal data within your organization’s systems
3. Automate
Automates privacy workflows and processes
4. Authenticate
Verifies an identity without requiring additional personal information
5. Partner
Offers a dedicated privacy program partner to ensure ongoing success

Depending on your organization’s size and privacy program, you may prioritize the requirements differently. We’ve included a few questions to detect which requirements your organization should prioritize.

1. Detect

Requirements for a Data Privacy Solution: DMAAP
Enumerates unknown systems containing personal data in your organization

Organizations store personal information everywhere — on locally owned databases, in cloud-based servers, in SaaS solutions (e.g. Salesforce, Snowflake, Slack, Shopify, Zendesk, Zoom etc.), and throughout their supply chain. A privacy program is only as good as the source of the data, so the first step for building your privacy program is to locate where all the personal data lives in your organization.

When evaluating a privacy solution, it's critical to understand how it identifies and takes inventory of all the places data is stored at an organization. Some solutions rely on you — the customer — to detect all the sources of data. Other solutions can detect new places where personal information is stored and data platforms that are unknown to you (also known as shadow IT). If you’re 100% confident you know where all data resides in your organization, you can opt for a solution that leans on you to take inventory of where data resides. For those who aren’t confident in their data locations, you should opt for a solution that can detect what systems you don't know about.

Most modern companies don’t know where all the personal data is stored on an individual. In fact, many companies don’t even know all the systems it uses that contain personal data.

2. Map

Discovers and maps personal data within your organization’s systems
A privacy solution should connect with your data sources so it can be updated in real-time to create a data map — a living blueprint of all the data in your organization. The data mapping functionality should automatically capture changes as new data is created & stored or a new data platform is added to your environment.

3. Automate

Automate privacy workflows and processes
A modern-day privacy solution should deliver automation with appropriate controls. First generations of data privacy solutions designed workflows and processes to help build the underpinnings of a privacy program. But with new regulations, manual processes and dozens of spreadsheets are no longer sustainable.

The value of automation is two-fold:

1. Efficiency - save time and money, and guarantee timely responses
2. Correctness and accuracy - automation eliminates the risk of human error.

Good privacy solutions automate repeatable processes and allow for organizations to add the appropriate controls and escalations. They are also designed to scale and easily add new functionality as new regulations emerge or existing regulations change.

4. Authenticate

Verifies an identity without requiring additional personal information
Your organization does not want to pass along personal information to the wrong person or to someone who is impersonating a customer. Currently, many privacy solutions ask people to provide additional data to verify their identity. To avoid upsetting your customers, find a privacy solution that uses existing personal information associated with a person’s record to securely validate the individual’s identity.

5. Partner

Offers a dedicated privacy partner to ensure ongoing success
Privacy is a journey, not a destination. You need a partner who’s going to help you every step of the way as you navigate a new regulatory space. That's why it’s critical to choose a privacy solution that continues to work with you (without extra fees!) and builds your privacy program beyond the initial implementation.

Conclusion

Choosing a privacy solution for your company should take into account your company size, number of anticipated DSARs, and how big your privacy team is. For larger, more complex organizations, prioritize a solution that can help you build a strong data foundation for your privacy program.

Most organizations want one privacy solution that can manage their entire privacy program, and the good news is that there are some solutions that rise to the occasion. We’ve found that privacy solutions that prioritize accuracy, create efficiencies, and automate tend to help organizations by ensuring transparency and reducing the risk of being fined.

About DataGrail

DataGrail helps companies comply effortlessly with existing and emerging privacy laws, such as GDPR, CPRA and CCPA. It was designed from the ground up to automate data discovery and streamline privacy programs to create less work for customers, while also ensuring a higher level of accuracy and reduced risk.