Privacy Experts International

rjbortnick@comcast.net

Businesses must recognize that they cannot ignore or take a relaxed approach to their data security and privacy compliance; it is a necessary and critical component or a company’s operations.

While the requirements for each business will be different, depending on the relevant industry, location, and other factors, there are some general practices we train businesses to follow so that they can meet their compliance obligations:

• Create and memorialize regulatory compliance policies and procedures that account for your specific business model;
• Provide compliance training to your key personnel to ensure that your company’s business culture comports with applicable regulatory schemes and regulators’ expectations;
• Inventory and assess the “personal information” you collect so you know what you have and what needs to be protected;
• Update a company’s website home pages to comply with applicable laws;
• Collaborate with experienced technical service providers to ensure that “reasonable security procedures” are in place and data is properly protected;
• Address nondiscrimination issues to provide consumers with the right to equal service and price; 
• Implement and regularly update appropriate incident response and business continuity plans and o Audit and/or obtain an assessment certification from the company’s vendors and others with access to their electronic infrastructure to ensure that the third parties are compliant with governing law and have cybersecurity protections, including insurance, at least as robust as that of the company. You’re only as strong as your weakest link.

In short, a company’s failure to comply with data privacy laws can have disastrous consequences if not managed properly. An effective data privacy program will go a long way in avoiding the myriad threats that could befall a non-compliant entity. A company’s future viability could be short-lived without it.