Consumer trust in online services is a growing preoccupation of today’s boardrooms. That’s because customers are increasingly prepared to walk if they don’t like what they see. In fact, 71% of consumers told PwC last year that they’re unlikely to buy from a company that loses their trust. This might happen following a serious data breach, or other privacy-related incident. Separate research shows that 68% would be put off buying online from a company with inadequate data security – rising even higher (75%) for firms which have breached customer data in the past.
The good news for organizations that want to burnish their privacy credentials and improve best practice is that a new ISO standard has just been published. ISO 31700 is based on privacy-by-design principles first developed in the 1990s, and could help by providing practical steps to implement these best practices.
Privacy by design was developed by Ontario Information and Privacy Commissioner Anne Cavoukian with the tenets that privacy can’t be guaranteed solely via compliance with regulations – that it must be the default setting for organizations and built into everything they do by default. It was published as a framework in 2009 and adopted eventually by the GDPR.
The new ISO standard adds plenty more detail to the approach and can be seen as a way to help organizations of all sizes to “operationalize” privacy by design. In so doing, they should become more resilient to possible incidents and may find compliance with GPDR and other laws easier.
Although ISO 31700 has 30 requirements, the original privacy-by-design document contains just seven principles, which summarize the approach fairly neatly:
It becomes obvious reading the above that to implement privacy by design, organizations need a way to ensure all customer data they process, via any service or back-end system, must be protected by default throughout its entire lifecycle. This is exactly the promise of comforte’s data-centric security approach.
Our Data Security Platform automatically and continuously discovers and classifies data before seamlessly applying strong protection in line with corporate policy. Format-preserving techniques for data protection, such as tokenization, mean data can still be used in analytics and other business use cases, without compromising on privacy-by-design principles.
According to the ISO, the benefits of implementing its new privacy-by-design standard are:
Earn consumer trust and satisfy demands for robust privacy and data protection.
Institutionalize robust privacy norms throughout the ecosystem – including privacy protection and data handling practices – ensuring decisions concerning consumer privacy needs will be more consistent and systematic.
Benefit from a more holistic and integrated approach by ensuring privacy best practices apply to the broader information ecosystems in which technologies and organizations operate and function.
Support an iterative approach to product development, so that privacy enhancements can be deployed long after the initial design phase.