Regulations Should Protect Citizen's Data

Protecting files and enabling ‘safe sharing’ of information will help improve digital adoption

India, in its 71st year of Independence, is witnessing enormous digital advances. While we continue to plug into the digital realm, there are huge risks lurking around the corner especially in terms of protecting the important privacy documents of the larger population in general. Robust data integrity, both inside and outside the perimeter of Public Sector Enterprises and Government institutions, including but not limited to third party affiliates and vendor organisations, will ensure long terms benefits for all stakeholders.

How safe are your ID proofs & KYC Documents?

While the government has made the right move with demonetisation, there is still much to achieve when it comes to the digital world. The government’s digital momentum initiative needs to address the rising security and privacy concerns of citizens. Large private organizations pull out all stops to ensure their information assets are protected both within their boundaries as well as from the risks outside their perimeter. In the same way, government files, documents, citizen details stored should also be right protected. The all-important question is, how safe is your important data like ID proofs and KYC Documents etc? We live and work in an always-on digital economy. Free movement of data, oils the wheels of today’s enterprise – as well as the modern-day government by making information flow seamlessly across enterprise borders.

While digitization helps improve information-sharing and collaboration amongst your different stakeholders, right protection is mission-critical to avoid any misuse of data. Protecting sensitive files and enabling ‘safe sharing’ of information will help improve digital adoption. In particular, soft copies of customers’ KYC documents and identification proofs needs to be protected, ideally with persistent data-centric security that travels with the files. It is equally important in cases of tax & land records, transaction files, court documents etc. that can be accessed and utilized by only authorized users. This will help build the citizen’s full trust in our digital march.

Should third party outsourcing vendors be regulated?

Hence there has to be a parallel initiative taken by Government wherein, security of digital data needs go hand in hand with digitization of data. It cannot be left aside in this fast-paced world. We also hope to see Government organizations placing stricter compliance regulations on their third-party outsource vendors and other external collaboration partners. Third-parties such as advisors, vendors, sub-contractors and business partners pose a huge risk to organizations because they require access to systems and data to conduct business, yet there is no accountability in the way they handle a company’s data. Besides unsecured systems, there is also the issue of sub-contractors stealing intellectual property.

What’s in store in the immediate future?

2017 will be a Historic Year for Cybersecurity Legislation. High-profile incidents such as the breaches at the Democratic National Committee and Yahoo, and the Apple encryption debate have increased public awareness around the importance of data security and privacy. In India too several Indian banks blocked and recalled more than 3.2 million debit cards, fearing fraud due to data leakage caused by a malware infection at a third-party ATM switch used by one of the banks. The growing awareness, coupled with the government’s willingness to acknowledge the national security risks posed by cyberattacks, makes us hopeful we’ll see meaningful progress made in the fight to create effective cyber-legislation.

Many countries such as the US and Israel have their own cyber security frameworks. Europe is leading the way with the General Data Protection Regulation (GDPR) act and we expect countries to follow with similar legislation. There is an urgent need for India also to have a robust cybersecurity framework in place to set up the backbone of stringent IT security measures in the country. This legislation may start with mandatory breach notifications, which initially eliminate undisclosed (or slowly disclosed) cyber incidents, but will eventually take the form of specific guidelines for how citizens’ data must be protected, wherever it travels or is stored.