Comprehending personal data’s locations is crucial for safeguarding and responding to breaches
In the Middle East, only 21% of organizations have successful data privacy programs, as per a Protiviti Member Firm survey. The report underscores challenges during the transition from design to implementation, including regulatory adherence and legal risks due to non-compliance.
Ranjan Sinha, Managing Director, Technology & Digital Consulting, Protiviti, said, “Data privacy has emerged as a critical concern for organizations worldwide, and the GCC region is no exception. The survey presents the current state of data privacy programs in the region and a roadmap for organizations to enhance their privacy practices, comply with regulations, and protect their customer sensitive information.”
“Data privacy has emerged as a critical concern for organizations worldwide, and the GCC region is no exception”
Ranjan Sinha, Managing Director, Technology & Digital Consulting, Protiviti
As per the report there is an increase in privacy program implementations across GCC countries with 56% respondents highlighting regulatory requirements as the primary driver along with the need to maintain consumer trust and contractual obligations as the other important driver.
However, findings indicate a lack of coherence in data privacy implementation initiatives, as the responsibility and ownership for the program are dispersed throughout the organization. Merely 27% of organizations have dedicated data privacy departments, while 40% assign data privacy as the primary responsibility of the information security department. The report urges organizational leadership to establish clear privacy-oriented roles, responsibilities, and governance structures and prioritize budget allocation for data privacy programs.
Niraj Mathur Managing Director, Security and Privacy Practice, Protiviti “Given our experience working with clients across the globe and especially in the GCC, a generic approach to privacy does not work. Organizations will need to consider their business context, current state, existing capabilities, and risk appetites while strategizing their data privacy program. Any gaps during implementing can have lasting impact due to stringent legal penalties and reputational risk from loss of customer trust.”
Comprehending personal data’s locations is crucial for safeguarding and responding to breaches. Notably, 76% of survey participants highlighted data visibility as the main hurdle in maintaining effective privacy programs. Approximately 75% foresee enhancing the Governance, Risk Management, and Compliance (GRC) requirements of their privacy programs as a significant area of investment this year, anticipating that regulatory bodies will conduct routine audits and inspections to oversee organization’s adherence to privacy regulations, similar to the roll out of cyber security regulations earlier. However, 43% of the organizations are yet to allocate a budget for privacy programs.
Ultimately, the survey report calls upon organizations to undertake a comprehensive data discovery exercise to identify and map out the collection, storage, processing, and transfer of personal data within their environment. It’s important that organizations plan their data privacy journey by following a strategic and proactive approach that considers various aspects, such as legal and regulatory requirements, privacy risk management, employee training and awareness, and data breach management.
