Data privacy requirements get more demanding every year. That makes sense in light of the multiple privacy and IT security scandals we’ve seen in the news. If your company is subject to the California Consumer Privacy Act (CCPA), you need to keep up with your obligations.
Defining the CCPA Compliance Burden
Fulfilling your corporate responsibilities under this act is essential for a few reasons. First, this piece of legislation carries significant fines in the event of a violation. Effective IT security data protection is far cheaper to maintain. Aside from direct penalties, the negative publicity associated with a significant fine is highly unattractive.
According to the National Law Review, CCPA may apply more broadly than you imagine:
[For] businesses that do not collect "consumer" personal information, it does not appear to be necessary under the CCPA for a business to be the one to collect personal information from consumers for the law to apply. So long as personal information is collected on behalf of a business (such as through a third party), the business could be covered by the CCPA, assuming the other requirements are satisfied.
We cannot provide legal advice. However, the above observation is interesting. It appears that CCPA is not limited to companies that collect and manage consumer data. Ultimately, it is probably best for your brand reputation to voluntarily seek to meet CCPA requirements. Since the law is so far-reaching, you are going to need help in the form of software to meet the requirements.
Using Software To Lighten The Load of CCPA Compliance
Reactive Measures
The following methods are ways to use software to react to CCPA problems when they occur. In essence, these approaches will mitigate the damage associated with a breach.
1. Meet CCPA reporting requirements by monitoring the internet
In the past, some companies have taken months or years to detect and disclose IT security incidents. If CCPA applies to your organization, taking months to report a breach is not a smart idea. According to CSO, “Companies have 30 days to comply with the law once regulators notify them of a violation. If the issue isn’t resolved, there’s a fine of up to $7,500 per record.”
Use software to scan your systems on a daily basis for breaches. You might also decide to search the dark web for your data as some hackers publish data obtained through hacks. However, waiting to see confidential data appear on the web is an incomplete solution. You also need to track where critical CCPA protected data resides in your systems.
2. Use software to track CCPA-related protected information
As a privacy protection law, CCPA covers a variety of types of data. Manually identifying all of these data points in your systems may not be sustainable. Therefore, seek out software that can track all CCPA-related information. This system would need to be able to identify data such as identifiers (e.g., postal address, passport number, Social Security number), web browsing history, employment information, geolocation data and much more.
Tip: You may not be able to find a single system to monitor both consumer and employee personal information. In that case, you will need to combine multiple systems to achieve CCPA compliance.
3. Track CCPA requests through a case or ticket management system
Preventive Measures To Reduce CCPA Compliance Burden
Limiting the damage of a breach is a start, but software can do much more than that. Use these software solutions to reduce the likelihood of a data breach.
4. Reduce inactive user accounts
The CCPA legislation expects that companies will take steps to put reasonable IT security safeguards in place. The legislation does not specify IT security products. Instead, you need to use your judgment to choose the solutions that are most likely to safeguard the protected information. To ease your CCPA compliance burden this week, start by reducing your inactive user accounts. These accounts represent a higher risk for disclosing personal data without authorization.
Design your inactive user account optimization project using our past article: Stopping Inactive User Account Risk Fast.
5. Reduce password reuse in your systems
When employees use the same password at home and at work, you have a problem on your hands. If an employee’s password for a social media platform is compromised, for example, that same password might be reused by hackers attempting to gain entry to your corporate systems. There are two ways to use software to address this challenge.
First, make life easier by requiring passwords to memorize fewer passwords. You can make this happen by implementing a single sign-on software solution. With a single sign-on solution, employees can focus their attention on creating one strong password instead of multiple weak passwords. Second, use an IT security chatbot to make it easy and convenient for employees to get new passwords even on the weekend.
What About Using Spreadsheets To Manage CCPA Compliance?
Some companies rely on complex spreadsheets to manage their compliance requirements. While these solutions can work, there are multiple problems associated with this approach to CCPA compliance.
- Spreadsheets are not purpose-built for governance and compliance activities. As a result, you would need to apply an elaborate series of compensating controls like passwords and segregated drives to make spreadsheets work.
- You would need to invest considerable effort to build and update a spreadsheet to cover compliance requirements. In essence, you will have to assign team members to build a specialized database. If you are worried about addressing the CCPA compliance burden, it doesn’t make sense to create and maintain a complex spreadsheet.
- A compliance system is only useful if it is easy to maintain accurate data. Unfortunately, it is far too easy for formula errors to corrupt or confuse compliance data.
The alternative to using spreadsheets for CCPA compliance
Instead of relying on spreadsheets, get IT security software that is purpose-built. If you need help creating your business case, we’ve got you covered: Get Your SSO Software Project Funded With a Business Case.
