Data Privacy Tools in 2022

Working out how to harness public data while protecting privacy is a hot topic in 2022. Using data in a way that benefits data subjects and the organizations consuming the data is about getting the balance right. All of which has led to increasing demand for data privacy tools.  

Effective privacy risk management helps build trust with stakeholders, effectively communicate your privacy practices, and meet compliance obligations. In this blog, I will glance at how businesses utilize three distinct types of privacy tools: technology, legal transfer, and privacy framework. 

Data Privacy Management Software 

According to Verified Market Research (VRM), the Data Privacy Management Software Tools Market size was $671M in 2020 and is projected to reach $1.9B by 2028, growing at a CAGR of 13.80% from 2021 to 2028.  

The biggest driver for privacy tech adoption is the need to demonstrate compliance. With rapidly rising privacy laws, the need to demonstrate compliance continues to grow. According to the Forrester Wave™, 59% of privacy professionals cite privacy-risk visibility as a critical driver for investing in privacy management software. 

According to an IAPP survey, the most demanded privacy management tools in 2021 were:  

• Data-mapping and Data-flow Tools 
• Privacy Risk Assessment and Management Solutions 
• Data Subject Access Rights (DSAR) and Data Subject Consent Tools 
• Privacy Legal Update Tools 

Data privacy management software allows businesses to manage privacy compliance. Companies use data privacy management software to automate manual processes, provide visibility, and leverage reporting tools. They also automate and streamline specific data privacy processes, such as fulfilling DSAR requests for data access, amendment, or deletion. Privacy managers and IT teams are the typical users of data privacy management software. 

Many data privacy management software have additional functionalities such as identity verification, privacy impact assessment (PIA), privacy policy generation tools, cookie tracking compliance, data breach notification functions, and the ability to integrate with other systems through APIs. 

Also, there is some overlap with closely related governance risk and compliance (GRC) and IT vendor risk management tools. Many of the leading vendors can offer a full suite of functions.  

Some data privacy management products specialize in a specific niche, such as the EU's General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD), and Canadas' Personal Information Protection and Electronic Documents Act (PIPEDA). Other products, such as OneTrust, are designed to apply across industries, company size, and legal compliance.  

Things to watch out for when purchasing privacy management software tools 

Know what you are looking for. 

Vendor solutions are typically modular and can do quite a few things for privacy at different price points, from data mapping to data subject access requests (DSAR). Additional capabilities may include third-party risk management, compliance monitoring, questionnaire response automation, logging and reporting, and GRC. Another important feature (usually at additional cost) is API integration capability. 

What out for feature creep affecting the price.  

Typically, initial subscription costs are transparent, while additional services can become expensive if not managed. 

Know your industry verticals, geography, and regulations.  

Some solutions have a strategy of covering many industries. Others specialize in specific regulated verticals (e.g., finance or healthcare) or particular regions, for example, GDPR in the EU. 

GDPR Legal Data Transfer Tools 

New EU data privacy laws impact US companies in 2022.  

In June 2021, the European Commission adopted a new set of standard contractual clauses (SCCs) for the transfer of personal data outside of EU countries such as the United States. 

The new 'pre-approved' SCCs replace previous SCCs adopted under a prior Data Protection Directive. As of September 2021, it is no longer possible to conclude contracts incorporating these earlier sets of SCCs. For contracts executed before September 2021, businesses can continue to rely on those earlier SCCs until December 2022.  

US businesses should assess and update their GDPR data transfer tools based on new EU guidance. They must update contracts to new EU standard contract clauses by December 2022. New 2022 contracts must use the new pre-approved SCCs, and all existing agreements need to be reviewed and updated by December. 

For more information on the new GDPR Transfer Tools, read about on  Blog, "EU Privacy New GDPR Data Transfer Tool."

NIST Privacy Framework  

Companies with mature security and privacy programs are leveraging the NIST Privacy Framework. In January 2022, NIST celebrated two years of the Privacy Framework. In 2020-2021 organizations across finance, healthcare, information technology, public sector, and trade associations used the framework to build, maintain and evolve their data privacy practices.  

"The NIST Privacy Framework is an essential tool for building and maturing a privacy program." – Harvey Jang, Chief Privacy Officer Cisco January 2021. 

The NIST Privacy Framework supports: 

• Building Trust with Stakeholders – Trust is a Competitive Advantage 
• Fulfilling Privacy Compliance Requirements  
• Communicating the Effectiveness of Your Privacy Program 

NIST recognizes that cybersecurity and privacy are distinct practices, yet there is an overlap of incidents impacting both. Organizations can use the cybersecurity and privacy frameworks in coordination. The idea is to build a collaborative approach between cybersecurity and privacy.

Many folks will appreciate the NIST regulatory crosswalks to compare guidance with essential Privacy Laws and Frameworks. The crosswalk collection includes the following: 

• California Privacy Rights Act (CPRA) 
• GDPR 
• Brazils’ Lei Geral De Proteção de Dados (LGPD) 
• Virginia Consumer Data Protection Act (VCDPA) 
• ISO/IEC 27701 

You needn't be a large fortune 500 to leverage the framework. As with the cybersecurity framework before it, the privacy framework is scalable and flexible to the size and focus of any business. NIST includes practical guidance for small and medium enterprises.  

Conclusion 

Today businesses of all sizes face a rapidly changing privacy-risk landscape and changes in privacy compliance requirements. In response, there has been tremendous growth of tools available to companies to build, maintain and evolve a mature privacy practice. The key to getting started is knowing your organizations' privacy requirements and objectives. 

Truvantis has the expertise to guide you through your requirements and the complexities of GDPR, Federal and State privacy laws. At Truvantis, we do not offer a one-size-fits-all solution. We'll work with you to build a privacy compliance solution unique to your business. Contact us today for a consultation.