New data protection bill draft is coming: 6 ways to ensure data security

Neelesh Kripalani, Chief Technology Officer, Clover Infotech

Speaking recently at the Global Fintech Fest’s third edition, Indian Union IT Minister Ashwini Vaishnaw said that in the next few days, the Centre will be coming out with a fresh draft of the data protection bill. The data protection bill is a landmark legislation meant to regulate how various companies and organizations use individuals’ data in India. The bill is aimed to provide protection of digital privacy to individuals relating to their personal data, specify the flow and usage of data, and create a relationship of trust between persons and entities processing the data. Such regulations are needed to safeguard the data and privacy of citizens.

What it means for the organizations?

It simply means that organizations need to stay on guard and ensure that the company's data is safe. They should know exactly how their data is used, who is using it, and where it is being shared.

Here are six ways in which organizations can ensure data security and ensure compliance with regulations:

#1 Zero Trust Security (Never Trust, Always Verify): This approach to cybersecurity assumes no barriers i.e. don’t trust anything by default, starting with the network. ‘Zero Trust’ ensures that critical assets can only be reached by those offering a positive proof that they have the credentials, identity, and need to access them.

#2 Data Loss Prevention (DLP): It’s a program that combines technologies, strategies, and processes to prevent unauthorized personnel from accessing an organization’s sensitive information. DLP technology relies on algorithms to detect and protect against instances of data loss, destruction, and unwanted access.

#3 Data Backup: This can help you recover faster from accidental file deletion to a complete ransomware lockdown. As a security best practice, backup data should be stored in a secure, remote location away from your primary place of business. Consider 3-2-1 rule for data backup which states that there should be 3 copies of data, 2 backups on different media, and 1 copy off-site.

#4 Data Encryption: Data encryption translates data into another form, or code, so that only people with access to a secret key (formally called a decryption key) or password can read it. Encrypted data, also known as ciphertext, appears scrambled or unreadable to the users accessing it without permission.

#5 Database Activity Monitoring (DAM): It refers to the auditing of database activities such as database access and modifications in real-time. While a number of tools can monitor various level of database activity, DAM tools are differentiated by their ability to trigger alerts on policy violations. DAM tools not only record activity but also provide real-time monitoring and rule-based alerting.

#6 Endpoint Security: It refers to securing endpoints, or end-user devices such as desktops, laptops, and mobile devices. These endpoints serve as points of access to the corporate network and sensitive data. Today more than ever, endpoint security plays a critical role due to remote or hybrid workforce.

Nothing can undermine the importance of being proactive. Cyber risks are here to stay or probably going to rise with the increasing adoption of digital tools and technologies. However, an organization's approach to cybersecurity will decide the impact of a cyber-attack. A proactive approach to cybersecurity can help organizations to minimize the impact of a data breach to a great extent as compared to the reactive approach. Unfortunately, in most cases, it takes a data breach to get the cybersecurity ball rolling in the organization. As we approach 2023, a proactive approach to cybersecurity and measures to create awareness on its importance among employees is the first and most important thing that organizations must address.