Data processing: protective measures your organization needs to follow

Every day the media reports a new leak of personal information, from the leak of bank details of financial institutions’ customers to the possible leak of the CPF (taxpayer) numbers of an impressive 220 million Brazilians (in Portuguese).

So that your company isn’t the next on the list to have its reputation damaged, I’ve put together some basic organizational security measures that you and your team can adopt to reduce the risk of your operations.

Create handling guidelines and train your team

Every process information goes through within the company counts as data processing, such as collection, storage, handling, transmission, sharing, modification, transformation and even deletion.

Create policies that describe how your team should use personal information throughout the whole process, making clear each person’s responsibility for handling personal data.

Remember that the policy only shows the way; you, the manager, are the key piece in making the policy part of everyone’s daily work, through training such as seminars and talks, control through monitoring and audits, and penalties where appropriate.

Classify and label information properly

Relax, relax. No need to panic thinking that labeling information means putting stickers on every folder, marking every drawer or cabinet and spending hours labeling everything in sight.

You’ll never see a “Vault room” sign on any door in a bank’s back office

We’re talking about properly classifying information so it doesn’t fall into the wrong hands. This classification lets you separate more sensitive information that needs more protection from information that doesn’t need as much. It’s a matter of prioritizing protection for what makes sense to protect.

So, what sensitive information does your team handle day to day? Have you ever stopped to think about it?

Set up scheduled data retention and deletion

You may be reading this at work (maybe you should be working right now, ha ha), so take the chance to do a practical exercise: try to find the oldest Excel spreadsheet you can on your computer. I’m sure you’ll find something that should have been deleted years ago.

Files containing personal information are often forgotten and live forever on a company’s network and backups. So, after properly classifying your information, set a retention period for each type of information on your network.

Make sure your scheduled deletion of records complies with the applicable laws on how long data must be kept, to avoid legal complications.

Keep an inventory of essential information

Imagine a warehouse that doesn’t decide where to store what, doesn’t track its stock and doesn’t even know which are the most expensive items that need more attention and protection. Would you be a partner in that company?

The analogy is simple, because information is exactly like physical assets. Just as a stockroom needs tight control over its most expensive items, any company needs tight control over its sensitive information, keeping an inventory of it to make sure it’s properly controlled.