It's Time for a Data Protection Checkup

We recently released the first BakerHostetler Data Security Incident Response Report, which provides insights generated from the review of more than 200 incidents that our law firm advised on in 2014. The report shows that human error was the number one cause of data security incidents we worked on last year, with employee negligence responsible for incidents 36% of the time. Other leading causes were theft by outsiders (22%), theft by insiders (16%), malware (16%), and phishing attacks (14%). As our report demonstrates, preventing unauthorized access is just part of the solution. Further, our report is limited to security incidents and does not even address data privacy and data hygiene (retention and destruction) issues. To fully address data privacy and security, companies should develop a comprehensive Information Governance (IG) program for managing their data. This article outlines a 10-step process to develop and maintain an IG program by: 1) Identifying data assets; 2) Conducting privacy and security assessments; 3) Regularly reassessing; 4) Identifying responsive and mitigating measures; 5) Implementing the measures; 6) Monitoring the operation and evaluating the effectiveness of the program; 7) Conducting education and training; 8) Addressing data in the hands of third parties; 9) Preparing for incidents; and 10) Considering insurance.

IG programs mature over time, but if your organization is not committed to developing and maturing an IG program, it will be inadequately prepared for the inevitable data privacy and security incidents that it will incur. Conversely, starting the process of good IG management will reduce the likelihood of incidents and better prepare a company for addressing them when they occur.