Tips for safeguarding SaaS data in highly regulated industries

Data has become a hugely valuable commodity to businesses, but as breaches become more common and privacy concerns more urgent, the regulatory risks have grown. 

A raft of new laws have been brought in to protect personal data, with around three-quarters of the global population set to be covered by such rules by 2025, according to Gartner. And rule breakers risk significant fines and reputational damage, especially if they operate in heavily regulated industries such as financial services, pharma or healthcare. 

With yet more legislation on the horizon, organisations will have to commit significant resources and investment to ensuring they remain compliant. So what risks are they likely to encounter, and how ready are they for what lies ahead?

Rachael Annear is a partner at law firm Freshfields Bruckhaus Deringer. She advises global companies on issues in data. Every organisation is “on its own journey” when it comes to compliance, and approaches vary widely, she says, although some do need to speed up. 

“In general, heavily regulated organisations tend to be very used to governance and accountability structures, but even they sometimes need to move faster to adapt to emerging data laws and the growing regulatory focus on data governance.”

Tailoring legislation

Data regulations will vary from company to company depending on size, sector and geography. But broadly speaking regulators globally have focused on two main areas when tightening up the rules: privacy and the protection of personal data, and digital advertising practices and the intersection between personal information and so-called ad tech.

While most countries have moved to bring in new laws, the EU has led the way with the General Data Protection Regulation (GDPR), which came into effect in 2018. The legislation establishes guidelines for the collection and processing of personal data so that it is fair, limited, accurate, secure and confidential. Firms must be able to demonstrate how they keep a check on these things. 

GDPR also imposes obligations on organisations wherever they are based, so long as they collect data in the EU – and the penalties can be huge. Recent examples have included a €1.2bn (£1bn) fine for Meta, €746m for Amazon and €345m for TikTok. 

Since then, Annear says the bloc has complemented GDPR with an increasing number of “sector-specific laws and laws with broad regulatory impacts on the handling of data”. These include the EU’s Digital Operational Resilience Act (DORA) in the financial services sector, and its Data Act, which applies to various businesses’ handling of both personal and non-personal data. 

“In terms of data protection regulation, the GDPR is often seen as a bit of a blueprint,” Annear says. “However, as privacy laws mature, we see examples of jurisdictions tailoring legislation to their own political, historical and cultural contexts.”

Geographic nuance

There is now a trend toward emulating GDPR around the world with the UK, many Middle Eastern countries, certain US states, Brazil, Canada, Australia and India all taking a similar path. 

That said, any company operating internationally must be aware of geographic nuances, says Nina Bryant, head of the UK information governance, privacy and security practice at FTI Consulting.

“Some countries may tighten or slacken their requirements to increase their attractiveness as a global business hub – a factor in some of the shifting laws in countries such as the UAE and Saudi Arabia. Others may weigh national interests against individual privacy protections, which is one of many factors in the US journey toward a possible federal privacy law.”

With new legislation on AI about to be passed in the EU, the regulatory scrutiny is bound to intensify, so organisations must have robust data protection strategies that cover not only data stored within their own domains, but also that held by third-party providers in the cloud, such as software as a service (SaaS) platforms. 

Complacency is not an option, and Annear stresses that each company will have to tailor its approach based on the data it is processing and the manner of processing. Firms must also keep an eye on the ever-evolving cyber risk landscape.  

“There is undoubtedly a correlation between the extent to which an organisation prepares for cyber-attacks and the harm – operational, financial, reputational and legal – caused by an incident,” she says. 

Crisis situations

Bryant says few companies are blind to regulatory risks, with the issue now taken much more seriously at board level. Yet while awareness and intention have improved, there are still gaps in execution. 

“We see many companies struggle with tackling, and thus effectively governing, the complexity of their data environments alongside a sometimes confusing patchwork of regulatory requirements. Moreover, data breaches continue to plague companies of all sizes, and in those crisis situations, many are unsure of how to effectively and correctly investigate the breach, identify what was lost and understand their notification requirements.” 

It is vital to ensure robust data protection processes are embedded across the whole organisation, she adds. This means leaders must buy into compliance and privacy as part of their company culture and values in order to establish trust with their clients or customers, setting the tone “from the top down”.

Rigorous assessment and governance of third-party providers is also critical as it remains a major area of risk exposure, and one that is likely to expand as organisations look to SaaS options for AI. 

“For any SaaS deployments and third-party partnerships wherein data is transferred and/or shared, organisations must make a regular practice of assessing and auditing their providers against all applicable data protection and privacy requirements,” says Bryant.

Daniel Thomas

In association with

Any company that has suffered a significant data breach will testify to the uncertainty and disruption it can cause. Not only may firms be left vulnerable to fraud, or incur penalties if they are later found to have breached data protection regulations,  but the downtime involved when recovering and restoring data can have a huge impact on business continuity. The reputational damage can also be severe.

As more and more company data is handled by third-party software-as-a-service (SaaS) platforms in the cloud, breaches have become more common, yet many firms are unprepared. 

The security of SaaS platforms themselves is rarely at fault – most of the major vendors have robust protections in place. The bigger problem is the lack of awareness among SaaS customers about how to protect their accounts and respond decisively with a strong backup and recovery plan.

Dangerous complacency

Often companies don’t realise that they share responsibility for data managed by third-party platforms, which can lead to a dangerous sense of complacency. 

According to research conducted by Forrester Consulting on behalf of Own Company, 62% of SaaS decision-makers and administrators are misinformed and ultimately unaware of their responsibility as it relates to backing up data and information. And only 39% recognise that regardless of the SaaS vendor of choice, their organisation as the SaaS customer is ultimately responsible for the backup and recovery of data.

“Breaches and downtime are inevitable with SaaS applications, but many firms wrongly assume their data is safe when they entrust it to third-party platforms,” says Eoghan Casey, who is vice president of cybersecurity strategy and product development at Own Company, a SaaS data protection provider. 

“This may mean they fail to take adequate precautions and breaches take much longer to resolve.”

Configuration issues, password sharing and the use of unmanaged or insecure personal devices can all create opportunities for canny attackers to penetrate a company’s IT infrastructure. And when a SaaS breach does happen, many customers assume the SaaS vendor will back their data up, but this is rarely the case. 

“Take document-sharing solutions such as Google Docs and Microsoft OneDrive,” says Casey. “They provide an exceptional service but don’t back up your data. That is your responsibility, not theirs.”

Stress testing

The answer is to have a good backup and recovery plan, which comprises the right tech, people and processes. Firms must also stress test worst-case scenarios to understand how they would respond if customer data was deleted or corrupted, and increasingly this is a regulatory requirement. 

A powerful backup solution should be implemented, although many firms are unaware that certain tools have limitations. 

“Many backup solutions back up onto the same cloud servers where customer SaaS data is stored,” says Casey. “But regulators increasingly want data to be backed up in separate locations to ensure it is truly secure.”

Own Company helps organisations around the world to secure their data and ensure business continuity in the event of a breach or outage. Its solution enables clients to understand data exposure risks and proactively strengthen their SaaS security posture. With continuous automated backups, proactive notifications of data loss or corruption, and user-friendly recovery tools, data can be seamlessly recovered in a separate location.

Additionally, the solution allows for quick seeding of quality data into any sandbox or sub-production environment for development, training or testing purposes. It also archives obsolete data from production environments to prevent overage costs, enhance performance and ensure compliance. 

Unlike its competitors, Own Company offers a bespoke approach that vastly speeds up the data recovery process. Rather than having to restore an entire data environment after a breach, Own Company’s system can parse through data records to isolate and fix gaps and inconsistencies, cutting recovery time by up to 71%.

Time machine

“Our continuous backup solution operates like a time machine, you can go back to any point you like and recover what you’ve lost,” Casey says. “Using blockchain, we also enable customers to verify their data after a breach if a regulator asks them to do so.”

The firm supports an array of clients from small businesses to blue chip companies, public sector agencies to government departments. It is also a verified member of the US Federal Risk and Authorization Management Program (FedRamp) – a federal government-wide compliance initiative that provides a standardised approach to security assessment, authorisation and continuous monitoring for cloud products and services.

“To truly secure your data you need a full understanding of the risks so you can adopt the right security posture,” concludes Casey. “You also need robust data protection processes embedded across the organisation, and buy-in from senior management who are key to implementation.”

A precision backup solution should underpin these efforts so firms are always prepared for the worst. 

“The more businesses rely on third-party platforms to boost productivity and streamline their operations, the greater the threat surface they will face. However, the faster they can recover from a breach the less damaging it will be.”

In association with

For more information please visit owndata.com

It is no secret that data is transforming how businesses operate, providing them with vital insights into their customers and operations. Yet managing the mountains of data that firms create is rarely straightforward, and many find themselves struggling to reap the benefits of data-driven innovation despite the clear opportunities available to them. 

IT infrastructure issues can make it hard to access and leverage data properly. Organisations must also remain cybersecure and compliant in an increasingly complex regulatory landscape, or risk facing serious financial costs and business disruption. 

So how can firms get on top of their data governance issues and reap the full benefits of data-driven innovation?

A richer picture

SaaScada is a London-based fintech firm that provides banking technology to financial services companies. Data is a crucial growth driver for the highly regulated companies it works with, enabling them to understand more about their customers and adapt their services, says boss Nelson Wootton.

“Data gives banks a much richer picture of their customer – what their spending habits are, their income and outgoings, and how much they save versus spend. This can help to reveal the truth of how their customers live their lives, enabling them to tailor products and services to suit.”

Armed with these insights, firms can embrace a truly “evidence-based” decision-making process before committing significant investment to new ventures, Wootton adds. AI is taking this process to the next level, making it easier to identify potential new areas of revenue generation, model and mitigate risks, and improve customer safeguarding. 

Yet despite the benefits, Wootton says many firms miss out because they don’t have good oversight and control of their data landscape. “You can have all the data in the world, but if you can’t access it and make it understandable, it’s worthless.”  

Part of the problem is that large companies typically have large volumes of data spread across multiple divisions and servers around the world, meaning this data ends up locked in silos and scattered across channels, cloud apps and internal systems. 

The use of myriad software platforms from different vendors can also create integration issues that further slow data transfer.

A blessing and a curse

“The sheer volume of data organisations have at hand is both a blessing and a curse,” says Nina Bryant, head of the UK information governance, privacy and security practice at FTI Consulting. 

“While more data can often lead to more insights, ‘more’ is only better up to a point and increases organisational cost and risk. When an organisation has vast amounts of disparate data from many different sources and for dozens of different uses, it’s a challenge to classify and categorise… or to find, analyse and protect high-value data.”

This gap becomes more problematic as firms rush to adopt AI-powered systems that only work properly when fed high-quality data. Algorithms also need to access data in real time to make good real-time decisions, but that’s impossible when there are serious latency issues due to poor integration.

“Innovation with AI is impossible without the right data strategy and architecture in place,” says Chin Heng-Hong, who is vice president of product management at Couchbase, a firm that helps organisations simplify the development and deployment of applications. 

“Organisations require complete control over where their data is stored, who has access and how it is used. Without this, the safe and effective use of generative AI cannot be guaranteed, as organisations may be accidently sharing sensitive or biased information, resulting in financial and reputational damage.”

Setting a good foundation

A proper data governance strategy is key to tackling these issues, and that involves building the right teams to steward data, improving work practices across the company and streamlining technology platforms. Firms also need the right software support, including proper backup solutions and master data management (MDM) platforms to help consolidate, clean and harmonise data.  

Bryant says she often sees organisations become overwhelmed by the scope and scale of their data governance needs. Yet despite the challenges in setting a governance framework, it is well worth the work and resources, as this will set the foundation for what the organisation wants to accomplish with its data and what processes will achieve those objectives. 

“When organisations start with a culture of compliance and a culture of good data governance, they are in a much stronger position to maintain data programmes that effectively mitigate risk and fuel innovation through a smart and efficient use of data,” Bryant says. 

“When the data house is in order, regulatory risks are reduced, data can be more quickly and easily understood to reveal opportunities and data will be cleaner and more accessible to feed into analytics, AI and other tools that drive business growth.”