CEO’s Guide to

Data Protection
and Compliance
GDPR | CCPA | HIPAA | GLBA | PCI DSS

By 2024, CEOs will be held personally liable for data breaches.

That’s why it’s essential the C-Suite understands the importance
of privacy, data protection - and therefore cybersecurity - and
how these functions support business goals.
Share this report

TESSIAN.COM/RESEARCH →
 By 2024 - according to Gartner - CEOs will be held personally
Why cybersecurity and liable for data breaches if it is found that the incidents

compliance matter now occurred because the organization did not focus on
cybersecurity or invest sufficiently in it.

Over the last several years - thanks

The bottom line: Cybersecurity is mission critical. That means
largely to data privacy regulations - business leaders need to prioritize data protection and
cybersecurity has become less siloed privacy. Step one is understanding the regulatory landscape. “To be successful in implementing
and more integrated with overall security change, you have to bring the
larger organization along on the
business functions. But in many
journey. How do you get them to
organizations, security leaders still believe in the mission? How do you
READERS WILL LEARN
don’t have a seat at the table. communicate the criticality? How do
you win the hearts and minds of the
This disconnect with the board can make communicating How compliance standards like the GDPR, CCPA,
people? CISOs no longer live in the
risk, opportunity, and cybersecurity ROI pretty difficult and HIPAA, GLBA, and PCI DSS have changed how
back office and address just tech
means compliance can be seen as more of a “box ticking businesses operate.
aspects. It’s about being a leader and
exercise” than anything that actually supports the
using security to drive value.”
business. The benefits of ensuring compliance (beyond just
avoiding fines) and why the C-suite should care.

But cybersecurity is more than a means to an end and KEVIN STORLI

The most effective ways to prevent data loss Global CTO and UK CISO at PwC
remaining compliant is about more than avoiding fines. A
and satisfy compliance standards.
data-first (and therefore human first) security approach
can be a business enabler and competitive differentiator.

And in a few years, it could also keep CEOs out of jail.

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 2

Good privacy is good for In your opinion, what is the biggest consequence of a data breach to an organization?

business: how privacy

creates value
We asked security leaders what they
viewed as the biggest consequence of a
21%
data breach. Nearly a quarter said losing 20%
customer trust. Just 10% said regulatory
fines. Why does this matter? 17%

It proves that compliance standards like GDPR, CCPA, HIPAA,

13%
GLBA, and PCI DSS have fundamentally changed how
11%
businesses across regions and industries operate. Customers, 10%
clients, and employees don’t just care about privacy. They
8%
expect it.

While this means a breach is bad news for everyone involved -

employees, the larger organization, and third parties like
customers, suppliers, or patients - it also means there are
benefits of privacy well beyond simply avoiding multi-million
dollar penalties.
Losing customers Lost data Damaged Lost intellectual Revenue loss Regulatory Fines Losing your job
and/or their trust reputation property

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 3

Percentage who had a data breach
According to Cisco’s global survey of security professionals and business
leaders, 97% of organizations who meet most (or all) the GDPR requirements
GDPR Ready 74%
enjoy one or more of the following benefits:
Least GDPR Ready 89%

1. COMPETITIVE ADVANTAGE 3. BREACH MITIGATION

Whether or not your business operates in a Organizations that fulfill their data privacy

Percentage who had breach losses > $500,000 highly-regulated industry or region (skip to pages 6, 7, obligations have fewer and less costly breaches.
and 8 for a high-level overview of 25 different laws and According to one study, GDPR-ready companies
standards), a strong privacy program and a track saw fewer records impacted, suffered smaller
GDPR Ready 37% record of transparency are competitive losses, and had shorter system downtime than the
differentiators. Yes, protecting data could help you least GDPR-ready companies.

Least GDPR Ready 64% attract new customers and clients and help you keep
the ones you already have. Bonus: Only 28% of
4. RICH DATA INSIGHTS
companies are currently fully compliant with the GDPR,
the “gold standard” of compliance. That translates to Businesses typically undergo a “data mapping” or

massive opportunity for those who put data privacy “data discovery” phase as a part of their
Number of records System compliance and data loss prevention program.
and protection first.
impacted downtime Oftentimes, in doing so, they uncover rich insights
into customer behavior and internal processes.
2. INVESTOR APPEAL That means privacy and compliance can actually
79K 212K 6.4 Hrs 9.4 Hrs help drive innovation, improve marketing
Given the number of high-profile data breaches we’ve
GDPR Ready Least GDPR Ready Least efforts, and increase operational efficiency.
GDPR Ready GDPR Ready seen in recent years (and the far-reaching
consequences of a data breach) investors are naturally
more interested in privacy-mature organizations.

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 4

“You’re only going to win more work if you’re
reputable. And you’re only going to be reputable if
you demonstrate you have a strong information
security framework.”
MARK PARR
Global Director, HFW

While we take a deeper dive into data requirements under the

GDPR, CCPA, HIPAA, GLBA, and PCI DSS starting on page 9
and detail the breach notification process on page 19, you
can use this checklist as a guide to help you understand what
steps you need to take to ensure general compliance.

Data Discovery

Implementation of Security Controls

Consent Management

Data Minimization

Usage Monitoring

Breach Notification

For more information about each of these steps - including a

Download Compliance Toolkit Now →
checklist - download Tessian’s Compliance Toolkit.

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 5

Data privacy regulation
across the globe
1
7

6
8

❶ CANADA — Personal Information Protection ❺ ARGENTINA — Personal Data Protection Act

3
and Electronic Documents Act (PIPEDA) A comprehensive privacy law that applies to all people and 2
A comprehensive privacy law that applies to all private sector organizations doing business in Argentina.
organizations (unless covered by provincial privacy law).

❻ EUROPEAN UNION — General Data Protection Act

❷ UNITED STATES (CALIFORNIA) — California (GDPR)
Consumer Privacy Act (CCPA) The world’s “gold standard” data protection law, covering all
Covers big businesses and businesses that “sell” personal aspects of personal information processing and privacy rights.
information (this could include you, even if you don’t realize it! 9

Skip to page 11 to learn more.)

❼ UNITED KINGDOM — Data Protection Act
Implements the EU GDPR in the UK, providing some specific
❸ UNITED STATES (NEW YORK) — New York exemptions in areas such as immigration and national security.
SHIELD Act 4

Data breach notification law that ALSO requires businesses to

❽ SWITZERLAND — Federal Act on Data Protection (FDAP)
implement a data security program.
Like the GDPR, but with smaller fines — and it also applies
to “legal persons” (e.g. corporations).
❹ BRAZIL — Brazilian General Data Protection
Law (LGPD) 5

Known as “Brazil’s GDPR,” the LGPD imposes data processing ❾ NIGERIA — Nigerian Data Protection Regulation 2019 (NDPR)
principles on all organizations and provides consumers with A strict data protection law with similar wording to the GDPR,
legal rights. applying to anyone processing personal information in Nigeria.

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 6

 ❿ SOUTH AFRICA — Protection of ⓫ CHINA — Personal Information
Personal Information Act (POPIA) Security Specification
Another broad, GDPR-inspired privacy One of several laws covering privacy and
law affecting all organizations operating in information security in China — aimed
South Africa. at businesses.

13
11 ⓬ INDIA — Personal Data ⓭ JAPAN — Act on the Protection of
Protection Bill Personal Information (APPI)
A strict and sweeping data protection law Applies to all private sector organizations
working its way through India’s lawmaking and requires consent for the sharing of
12 bodies — due to pass in 2020. personal information.

⓮ AUSTRALIA — Privacy Act 1988 ⓯ NEW ZEALAND — Privacy Act 2020

Imposes the 13 Australian Privacy Principles, Comes into effect on December 1, 2020, with
such as transparency and security, on public new data breach notification rules, bigger
bodies and businesses with a turnover of over fines, and application to foreign businesses.
AUD 3 million.

“Cybersecurity professionals have this absolute obligation to maintain security and

14
respond to threats appropriately, all whilst respecting privacy rights and
10
obligations. That’s a challenge.”

15 EMILY FISHER
Data Privacy Manager, Clifford Chance

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 7

 Retail/eCommerce/
Data privacy by industry Payment processing
Energy Finance
Payment Card Industry Data
ISO/IEC TR 27019 → Gramm-Leach-Bliley Act Security Standard (PCI DSS) →
(GLBA) →
Information security guidelines for US federal law for any business that is Applies to all organizations that accept,
utilities providers. “significantly engaged in providing transmit, or store information associated
financial products or services.” with payment cards.

App developers
Payment Card Industry Mobile Payment
Acceptance Security Guidelines →
Healthcare
Provides standards for accepting payments over mobile apps. Health Insurance Portability and
Accountability Act (HIPAA) →
Covers healthcare providers, health plans,
health clearinghouses, and their business
associates.

Manufacturers Software developers

Children’s online Cloud service
Payment Card Industry PIN Payment Application Data
services providers Transaction Security Security Standard (PA-DSS) →
Children’s Online Privacy ISO/IEC 27017:2015 → (PCI PTS) →
Protection Act (COPPA) → Helps developers create secure
Helps manufacturers create secure payment apps.
Code of practice providing information
US federal law applying to anyone security standards from cloud service
Legal/Forensics payment-processing equipment.

operating a commercial website, online providers.

ISO/IEC 27037:2012 →
service, or mobile app aimed at
children under 13.
Guidelines for identification, collection, acquisition,
and preservation of digital evidence.

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 8

 What data is protected What are the requirements under GDPR?
GDPR
■ Personal data (information that relates to ■ Organizations must only process personal data where they have
Overview a lawful basis for doing so. For example: they have the consent
an identifiable individual) including:
of the individual, they are legally obliged to process the
■ Name individual's personal data, and/or it is in their legitimate
What is it?
■ Address interests to process the individual's personal data.
The world’s “gold standard” for data protection laws that covers all
aspects of personal information processing and privacy rights ■ ID card/passport number ■ Organizations must facilitate the data subject’s rights,
including the rights of access, erasure, rectification, and data
■ Credit card information portability
Who enforces it?
The Data Protection Authorities that operate in each country where the ■ Cultural profile ■ Data can (normally) only be processed for the
GDPR applies. In the UK, it’s the Information Commissioner's Office ■ IP address reasons it was collected
(ICO) ■ Data must be accurate and kept up-to-date or
■ Health information
should be erased
When was it enacted? ■ Data must be stored no longer than necessary
May 25, 2018 (specifically when a subject is identifiable)
■ Data must be processed and stored securely and should be
Who is obligated to comply? Special categories of data pseudonymized, encrypted, or anonymized where appropriate
Any organization or person that collects personal data or behavioral
■ Anyone who handles data (full-time staff, third-party
information from someone in the EU ■ Racial or ethnic origin contractors, temporary employees, volunteers) should
■ Sexual orientation be trained in data protection, privacy, and handling
What are the penalties for non-compliance?
■ In most cases, organizations must appoint a
A fine up to €20 million or 4% of a company’s annual revenue, ■ Political opinions Data Protection Officer (DPO)
whichever is higher
■ Religious or philosophical beliefs ■ Organizations must take appropriate technical and
organizational measures to ensure the level of security
■ Trade-union membership is appropriate to risk
"Tessian exceeded the expectations of our GDPR team. You simply cannot
beat seeing for yourself what the product is capable of against your own ■ Genetic, biometric, of health data ■ Data protection authorities (and affected data subjects)
organization's data." must be notified in the event of a data breach
■ Data related to criminal convictions or offenses
MARK ELIAS (not "special category data," but also requires special protection)
IT Infrastructure Manager, Coastal Housing

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 9

 OTHER RESOURCES

GDPR GDPR Enforcement Tracker →

10 Biggest GDPR Fines of 2020 (So Far) →
Biggest Breaches (and Fines) to Date 3 Ways GDPR Has Affected Cybersecurity →

$124 $56.6 $56.6

*
million million million

What happened What happened What happened

383 million guest records (30 million EU residents) were exposed In early 2019, french regulator CNIL found that Google wasn’t H&M’s GDPR violations involved the “monitoring of several hundred
after the hotel chain’s guest reservation database was sufficiently informing customers about how they collected data to employees.” After employees took vacation or sick leave, they were
compromised. PI like guests’ names, addresses, passport personalize advertising. That means that there wasn’t actually a required to attend a return-to-work meeting. Some of these
numbers, and payment card information was exposed. Note: The data breach. Instead, Google was fined for a lack of transparency. meetings were recorded and accessible to over 50 H&M managers
hack originated in Starwood Group’s reservation system in 2014. who gained “a broad knowledge of their employees’ private lives”
While Marriott acquired Starwood in 2016, the hack wasn’t which was then used to help evaluate employees’ performance and
detected until September 2018. How it could have been avoided make decisions about their employment.
To start, Google shouldn’t have “pre-ticked” the option to
personalize ads for new users creating an account. Google also
How it could have been avoided should have provided more information to users in consent
How it could have been avoided
The ICO found that Marriott failed to perform adequate due policies, and should have granted users more control over how H&M shouldn’t have collected - or shared - personal information,
diligence after acquiring Starwood. They should have done more their personal data was processed. particularly special categories of data about people’s health and
to safeguard their systems with a stronger data loss prevention beliefs without doing so for a specific and justifiable purpose.
(DLP) strategy and utilized de-identification methods. H&M should also have placed strict access controls on the data and
the company should not have used this data to make decisions
*
Amount proposed by the ICO in July 2019. The fine hasn’t yet been finalized. about people’s employment.

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 10

 What data is protected What are the requirements under CCPA?
CCPA
Overview
■ Personal data (information that relates to an ■ Organizations must uphold the CCPA
identifiable individual) including: Consumer Rights, including:

■ Name ■ The right to know

What is it?
■ Address ■ The right to delete
Covers big businesses and businesses that “sell” personal information
(this could include you, even if you don’t realize it!) ■ ID card/social security number ■ The right to opt-out
■ Credit card information ■ The right to non-discrimination
Who enforces it?
■ Cultural profile ■ The right to opt-in (for minors)
The California Attorney General
■ IP address
■ Organizations must maintain reasonable security procedures
When was it enacted? ■ Medical information
and practices in order to prevent unauthorized access,
January 1, 2020
■ Biometric data exfiltration, theft, or disclosure
■ Health insurance information
Who is obligated to comply?
■ Organizations must provide notice to consumers including:
If you have a website that attracts visitors from around the world,
chances are you’re obligated to satisfy the CCPA. It applies to any ■ Privacy policy
■ The CCPA’s definition of “personal data” is even broader
for-profit business in the world that has an annual gross revenue in
than the GDPR’s and includes: ■ Notice of collection
excess of $25 million, that buys, sells, or shares the personal
information of more than 50,000 California residents annually, or that ■ IP address ■ Notice of the right to opt-out
earns 50% or more of its annual revenues from selling consumers’ PI. ■ Cookie data ■ Notice of financial incentives
■ Device ID
What are the penalties for non-compliance?
■ Geolocation data ■ Organizations must not “sell” personal information to another
Civil penalties can amount to $7,500 per violation. Statutory damages
business or third-party
related to breaches range from $100 to $750 per consumer, per incident ■ Pixel tags
or actual damages, whichever is greater.
■ The California Attorney General (and affected data subjects)
must be notified in the event of a data breach

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 11

 OTHER RESOURCES

CCPA CIS’s Guide to CCPA’s Minimum Requirements →

CCPA FAQs: Your Guide to California’s New Privacy Law →
Biggest Breaches (and Fines) to Date CCPA and GDPR Comparison Chart →

$500 million to Undisclosed $1 million to

$3.75 billion amount $7.5 million

What happened What happened What happened

According to the case docket and Zoom’s blog post, Zoom shared According to the case docket and Marriott’s own According to the case docket and data breach notification, between
user data - including device type, advertising ID, mobile OS type, announcement, the PI of 5.2 million people was exposed in a September 16, 2019 and November 11, 2019, hackers deployed
and more - with Facebook without notifying users. This appears data breach after the login credentials of two employees were malware to the website of children’s retailer Hanna Andersson
to have been the result of Zoom allowing users to “Login with compromised. Marriott believes the activity started in (hosted by Salesforce) and scraped customers’ names and payment
Facebook”, but even non-Facebook users were affected. So, how mid-January 2020. The login credentials weren’t disabled information. The PI of over 10,000 California consumers was later
big was the breach? According to the complaint, “millions” of until the end of February. found being sold on the Dark Web. The Office of the Attorney
users could claim statutory damages. General and consumers weren’t notified until over a month later.

How it could have been avoided

How it could have been avoided How it could have been avoided
Marriott is being accused of failing to “institute the most basic
While this may seem like an issue relating to opt-ins, it has more cybersecurity policies and procedures”, failing to “exercise While Hanna Andersson and Salesforce should have better
to do with cybersecurity. Because Zoom is alleged to have “failed reasonable care” and failing to train employees on policies protected users’ PI with security controls and more effectively
to properly safeguard the personal information of users”, the and procedures. In a nutshell: Marriott could have avoided the monitored the website and ecommerce platform for security
potential violation will be classed as a failure to implement breach with stronger cybersecurity controls (network security vulnerabilities, they’re also being accused of failing to notify
reasonable security. and email security specifically) and training. consumers of the breach properly. This shows the importance of
investigation and remediation and seamless reporting processes.

*
This information is based on class-action complaints brought by consumers that have not yet been resolved. Some occurred
A CEO’S
prior GUIDE
to CCPA TO DATA
enforcement but arePROTECTION AND
(nonetheless) being COMPLIANCE
pursued as CCPA violations. Speculative fines have been calculated TESSIAN.COM/RESEARCH → 12
- when possible - based on the number of users affected and the CCPA’s penalties for non-compliance.
 What data is protected What are the requirements under HIPAA?
HIPAA
Overview ■ Public Health Information (PHI) includes any information
that could be used to identify an individual, such as: ■ Organizations must carry out a risk assessment

■ Names
■ Organizations must implement administrative, physical, and
■ Dates directly related to an individual technical safeguards, including training to ensure
What is it?
■ Phone numbers compliance by their employees
Healthcare-specific federal law that protects
sensitive patient health information ■ Email addresses
■ Organizations must ensure the confidentiality, integrity,
■ Social Security numbers and availability of electronic PHI (e-PHI) they create,
Who enforces it?
■ Medical records/medical record numbers receive, maintain, or transmit
The US Department of Health & Human Services,
and other agencies such as Centers for Medicare ■ Health insurance information
■ Organizations must identify and protect against reasonably
and Medicaid
■ Account numbers anticipated threats to the security or integrity of e-PHI and
protect against impermissible uses or disclosures
When was it enacted? ■ Vehicle identifiers
August 21, 1996 ■ Device identifiers and serial numbers
■ Organizations must modify and review their security
■ IP numbers measures to continue protecting e-PHI in a changing
Who is obligated to comply?
environment (internal and external)
Most health care providers (including doctors, clinics, ■ Biometric identifiers
hospitals, nursing homes, pharmacies), health plans, ■ Full photographic images ■ Organizations must notify relevant parties (patients, the
healthcare clearinghouses, and their business associates
■ Geographical identifiers HHS, etc.) in the event of a data breach

What are the penalties for non-compliance?

Fines of up to $50,000 per violation, with an annual
maximum of $1.5 million per violation and/or prison terms “The added value of Tessian is that it influences behavior. That really resonated
of up to 10 years with the board and helped me make a strong business case. While I can’t show how
cybersecurity creates revenue, I can show the potential fines we could avoid
because of our investment in Tessian.”

CAS DE BIE
CIO at Cordaan

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 13

 OTHER RESOURCES

HIPAA At A Glance: Data Loss Prevention in Healthcare →

HIPAA Basics for Providers: Privacy, Security, and Breach Notification Rules →
Biggest Breaches (and Fines) to Date US Data Privacy Laws: What You Need to Know →

$16 $6.85 Undisclosed

million million amount

What happened What happened What happened

After Anthem Blue Cross’ computer system was hacked, the data In May 2014, Premera Blue Cross was targeted by a spear After multiple health insurers (including Anthem and Premera Blue
of around 78.8 million people was stolen, including names, phishing attack which installed malware on the healthcare Cross) were breached, Excellus proactively hired a cybersecurity
birthdays, addresses, medical IDs, social security numbers, and provider’s network, giving them access to their IT system. After firm to conduct a forensic assessment of its IT systems. They found
employment information. The insurance company settled with going undetected for nine months, the PI of more than 10.4 that hackers had gained access to administrative controls and
affected patients for $115 million in 2017 before shelling out $16 million people was exposed, including health plans, clinical therefore data (financial account information, claims information,
million in the HIPAA settlement. information, names, addresses, and social security numbers. names, dates of birth, social security numbers, etc.) related to 10.5
million people. According to financial filings from 2015, the breach
cost Excellus $17.3 million in the 4.5 months following its discovery.
How it could have been avoided How it could have been avoided
While Anthem denies liability, specialists say Anthem didn't take The OCR found “systemic non-compliance” with the HIPAA
steps to protect data in its computers through encryption and Rules which means Premera Blue Cross should have invested
How it could have been avoided
other controls, policies, and procedures that would prevent more money, time, and resources into privacy and While it appears the HIPAA investigation is (still) ongoing - and they
hackers from gaining access to employee login credentials and cybersecurity, conducted an enterprise-wide risk analysis, and claim the data was encrypted - any pending violations will be
other systems and data. Bonus: Did you know that credentials implemented risk management and audit controls. In particular, related to a failure to protect sensitive data with administrative,
are the most frequently compromised “type” of data in though, they should have invested more in inbound email physical, and technical controls.
phishing attacks? security to prevent the spear phishing attack.

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 14

 What data is protected What are the requirements under GLBA?
GLBA
Overview ■ Financial privacy rule:
■ Names
■ Provide a privacy policy explaining how personal
■ Addresses information is collected
■ Phone numbers ■ Allow customers to opt out of the disclosure of their non-public
What is it?
personal information to non-affiliated third parties
US federal law requiring financial institutions to explain how they use, ■ Bank account numbers
share, and protect customers’ personal information ■ Pretexting rule:
■ Credit card numbers
■ Income and credit histories ■ Safeguard against the obtaining of financial information
Who enforces it?
via false, fictitious, or fraudulent statements
Various agencies, including the Federal Trade Commission (FTC) and ■ Social Security numbers
federal banking authorities, and state-level insurance regulators ■ Safeguards rule:

■ Designate one or more employees to coordinate an

When was it enacted?
information security program
November 1999
■ Identify and assess risks to personal information in
all operational areas
Who is obligated to comply?
Any business that is “significantly engaged in providing financial ■ Evaluate the effectiveness of current safeguards
products or services,” including banks, securities firms, insurance ■ Design and implement a safeguards program
companies, financial advisers, and other financial service providers
■ Only use service providers that can maintain

What are the penalties for non-compliance?

“We were looking for the right data loss appropriate safeguards

Financial institutions can face fines of up to $500,000, 5 years prevention solution for two years. We ■ Implement a contract with service providers ensuring
imprisonment, or both loved the machine learning-powered that they will maintain safeguards
approach Tessian offered.” ■ Oversee service providers’ processing of personal information
■ Evaluate and adjust the safeguards program in light of
CHRIS TUREK relevant circumstances, operational changes, and the
CIO at Evercore results of security testing

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 15

 OTHER RESOURCES

GLBA Ultimate Guide to Data Protection and Compliance in Financial Services →

How to Comply With the GLBA →
Biggest Breaches (and Fines) to Date* FDIC’s Compliance Manual for GLBA →

$575 Undisclosed Undisclosed

million amount amount

What happened What happened What happened

Between May and July 2017, hackers exploited a vulnerability in This one isn’t a breach in the sense that customer data was In 2018, the FTC filed a complaint against PayPal - which acquired
Equifax’s unpatched software and gained access to the private exposed. It’s simply a breach of the GLBA’s Safeguards Rule. In a Venmo in 2014 - for failing to satisfy data requirements contained in
records of over 147 million customers. In January 2020, the nationwide sweep monitoring compliance with federal privacy laws, both the GLBA and FTC Act and for misleading customers.
company agreed to a global settlement with the Federal Trade Nationwide was found to have failed to comply with a number of
Commission (FTC), the Consumer Financial Protection Bureau, data requirements (see below). In the end, the company was
and 50 U.S. States and Territories. The settlement also included a ordered to retain an independent professional to certify its security How it could have been avoided
$425 million payout to customers who were affected by the program on an ongoing basis. No fine was issued. According to the FTC, Venmo didn’t have a written information
breach. security program until August 2014 and, until 2015, hadn’t
implemented basic safeguards to protect data or created processes
How it could have been avoided for customer support. Step one? Data discovery.
How it could have been avoided Again, it comes down to DLP. Nationwide should have assessed
Equifax “failed to undertake numerous basic security measures” risks to sensitive customer information, implemented safeguards to
and, according to a House Oversight Committee report, the control these risks, trained employees on information security
breach was “entirely preventable”, had the credit agency issues, maintained clearer oversight of how loan holders’ handle
patched a vulnerability they were warned about months prior. customer information, and better monitored its computer network
for vulnerabilities.

*
Breaches of GLBA tend to be mixed up with breaches of other laws, the settlement almost always involves remedial action
A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 16
rather than penalties, and, because there is no private right of action under the GLBA, there are no lawsuits.
 What data is protected What are the requirements under PCI DSS?
PCI DSS
Overview Cardholder data
■ Installing and maintaining a firewall
■ The full primary account number (PAN)
(long card number) ■ Changing vendor-supplied default passwords and security
■ Full PAN in combination with: parameters
What is it?
Information security standard protecting credit card data ■ Cardholder name ■ Protecting stored cardholder data via encryption, hashing, and
■ Expiry date other methods
Who enforces it?
■ Service code (CVV2/security code) ■ Encrypting cardholder data whenever transmitting over public
Credit card companies that are members of the PCI Security Standards
networks
Council: American Express, Discover, JCB International, MasterCard
and Visa Inc. ■ Protecting systems against malware

When was it enacted? ■ Developing and maintaining secure systems and applications
December 2004 TESSIAN RESEARCH
■ Restricting access to cardholder data to authorized personnel
Cashing in: How hackers target retailers on a “need to know” basis
Who is obligated to comply?
with phishing attacks
People and organizations working with and associated with payment ■ Identifying and authenticating access to networks, servers, and
cards, including: merchants, financial institutions, point-of-sale applications, including by assigning a unique ID to personnel
vendors, hardware and software developers
■ Restricting physical access to cardholder data
What are the penalties for non-compliance?
■ Logging and monitoring access to cardholder data and network
While penalties are rarely made public (and vary depending on the
resources
contract between the credit card company and the card-issuing bank,
and between the bank and the merchant or financial institution) ■ Testing security systems and processes regularly
organizations can be fined up to $100,000 a month. See Resources on
the next page for more information. ■ Maintaining an information security policy, including staff
LEARN MORE → training

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 17

 OTHER RESOURCES

PCI DSS Payment Card Industry Standards: Compliance Burden or Opportunity →

Cashing In: How Hackers Target Retailers with Phishing Attacks →
Biggest Breaches (and Fines*) to Date PCI DSS Quick Reference Guide →

Undisclosed Undisclosed Undisclosed

amount amount amount

What happened What happened What happened

While Heartland was actually deemed PCI DSS compliant at the In 2007 - and over the course of 18 months - 94 million Between April and September 2014, 56 million credit cards and 52
time, they nonetheless suffered a breach after five men - who credit cards were compromised. Hackers allegedly planted million email addresses were compromised after hackers accessed
were involved in a worldwide hacking and data breach scheme - unauthorized software on the retail giants computer Home Depot’s network with a vendor’s username and password and
targeted them. 160 million customers had their credit card network, enabling them to steal hundreds of files containing installed malware on self-checkout registers.
numbers stolen, resulting in hundreds of millions of dollars in data on millions of accounts. Hackers also cracked TJX’s
losses. Heartland settled with Visa, Mastercard, and Amex, lost data encryption system, allowing them to access
their PCI DSS compliance for 4 months, were forced to pay unencrypted data during the checkout/payment process. How it could have been avoided
out/lost a total of $200 million, and, within a few months, their According to the SANS institute, “the implementation of P2P
stock price had fallen by over 77%. encryption and proper network segregation would have prevented
How it could have been avoided the Home Depot data breach”. But, since credentials are frequently
There were multiple points of attack in this breach, but stolen in phishing and spear phishing attacks, strong inbound email
How it could have been avoided better data encryption methods, firewalls, data monitoring, security across the supply chain is also essential.
The payment processing provider was hacked by a successful SQL and training would all help safeguard TJX’s sensitive
injection attack. So, how do you prevent one? Strong network customer information.
security, strict access controls, and patch management.

*
Because card companies don’t reveal any information about the fines that they have issued on acquiring banks and,
A CEO’S
likewise, GUIDE
banks don’tTO DATA
reveal PROTECTION
any information AND
about how theyCOMPLIANCE
have recovered such fines from merchants, we can only TESSIAN.COM/RESEARCH → 18
provide information about the size of the breach and settlement costs, not the fines issued.
 Step 2: Notification
What needs to Breaches generally have to be reported “as soon as possible”. In the case of GDPR, though,

happen immediately Step 1: Investigation

it’s within 72 hours. Within that period you must draft a notification letter explaining the nature
of the breach, who has been affected, and what steps are being taken to mitigate the breach.

after a breach is ■ Assemble a team of experts and identify a data forensics team
Who has to be notified? The enforcement agency (under the GDPR, it’s the lead Data
Protection Authority), any individuals affected, and, under most US data breach laws, the
discovered? ■ Consult with legal counsel state Attorney-General and consumer reporting agencies must also be notified.
■ Interview people who discovered the breach
Beyond just the mandatory notifications, most companies must also invest in crisis
■ Follow internal reporting process
communications campaigns to control the narrative from a PR perspective and protect brand
We talked about the long-term consequences ■ Containment
reputation. These campaigns cost an average of $400,000 and involve strategic counsel
of a breach, including cost, lost customer ■ Secure physical areas from either external agencies or in-house PR teams who will prepare spokespeople for media
■ Take systems offline interview sand press conferences, craft public statements, and field inbound media requests.
trust, and damaged reputation on page 3. But
■ Remotely disable endpoints
what about the immediate aftermath? The Note: Some US laws also require companies to offer paid credit monitoring services to individuals affected
■ Reset passwords for a period of time following the breach. Organizing this can be very resource-intensive.
breach notification process is painful,
■ Change access rights
labor-intensive, and generally involves
■ Risk assessment:
several teams, including the C-suite. ■ Who was affected?
■ What data was compromised?
On average, it takes companies ■ What caused the breach?
197 days to identify and 69 days ■ Who needs to know (including service providers who may have Step 3: Evaluation
been affected)?
to contain a breach.
■ Do you need to hire external support? After a breach, companies need to show regulators that they are being proactive in trying to
■ How severe is the breach? prevent further data loss. That means updating policies, implementing new solutions, training
This list of to-dos should help you understand
employees, and adopting a stronger security culture. Fast. This will also generally involve
your regulatory obligations and what the hiring new security professionals and onboarding external security/IT support. Don’t forget,
The bottom line: There’s a lot to do in the immediate aftermath of a breach
minimum requirements are post-breach under you’ll need to report any changes to the regulators which requires even more time.
and employees will have to drop tools on existing initiatives and
compliance standards like the GDPR. revenue-generating projects. This will impact productivity and cause
You can avoid this arduous process and save valuable time and money by investing in
operational disruption. And that’s only step one.
cybersecurity solutions that prevent breaches from happening in the first place. It’s worth it.
According to a recent report, the cost of non-compliance is 2.71 times higher than the cost of
compliance.

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 19

How can Tessian help ensure compliance?

General Data Protection California Consumer Privacy Act Health Insurance Portability & Gramm–Leach–Bliley Act Payment Card Industry Data
Regulation (GDPR) (CCPA) Accountability Act of 1996 (GLBA) Security Standard (PCI DSS)
(HIPAA)
INDUSTRY INDUSTRY INDUSTRY INDUSTRY

All organizations that process personal data All businesses in California that meets at least one INDUSTRY Organizations that provide financial products / Any industry that deals with cardholder data such as
of EU residents. of the three criteria: Annual gross revenue of $25 M; services to customers. Retail, FSI.
Healthcare
derive 50% of annual revenue from selling
customer’s personal information; and buy / sell / WHAT TYPE OF DATA WHAT TYPE OF DATA
WHAT TYPE OF DATA
receive / share personal information of >50,000 WHAT TYPE OF DATA
Personal data of EU residents. ■ Nonpublic personal information (NPI) Payment card data in paper and electronic form
customers Personally identifiable electronic health
■ Personally identifiable information (PII) during both storage and transmission.
information (ePHI)
MANDATES WHAT TYPE OF DATA
All end-user data collected by company websites MANDATES MANDATES
Protect against unauthorized or unlawful MANDATES
using cookies and other tracking technology. ■ Ensure the secure collection, disclosure and ■ Implement strong access control programs around
processing and accidental loss, destruction
■ Ensure the confidentiality, integrity and
or damage of personal data. protection of consumers’ NPI and PII cardholder data.
availability of all ePHI data through its lifecycle
MANDATES ■ Develop a written information security plan to ■ Maintain a comprehensive
(created, received, maintained or transmitted)
Empower users with new data rights protect customers’ NPI and PII vulnerability program.
PENALTIES ■ Identify and protect against threats and
(the first in the US), such as the right to opt-out, the
impermissible uses
Fines of up to 4% of the company’s annual right to disclosure of what data has been collected, PENALTIES PENALTIES
worldwide turnover or €20 million, and the right to deletion of that data.
whichever is higher. PENALTIES ■ $100,000 fine per violation for the organization ■ Non-compliance fines of up to
■ Fines of up to $50,000 per violation, with an ■ $10,000 fine per violation or up to 5 years in $100,000 / month
PENALTIES
annual maximum of $1.5 million prison for personally liable officers ■ Suspension of card acceptance
■ $7,500 per intentional violation or $750 per
■ Prison terms of up to 10 years.
affected user
HOW TESSIAN HELPS CUSTOMERS
■ $2,500 for violations lacking intent
STAY COMPLIANT?
HOW TESSIAN HELPS CUSTOMERS HOW TESSIAN HELPS CUSTOMERS
HOW TESSIAN HELPS CUSTOMERS
STAY COMPLIANT? STAY COMPLIANT?
HOW TESSIAN HELPS CUSTOMERS STAY COMPLIANT?
Tessian Guardian automatically prevents
Customers use Tessian Constructor to track and Tessian can identify payment card data such as
accidental sharing of personal data with STAY COMPLIANT? Tessian Guardian prevents accidental data loss of
block PII such as social security and passport credit or debit card numbers and, if it appears it’s
unintended recipients. Tessian Guardian automatically prevents accidental sensitive patient data through misdirected emails.
numbers from being sent externally. being sent to an incorrect or unauthorized recipient,
Tessian Enforcer tracks and blocks personal sharing of personal data with unintended recipients. Tessian Enforcer tracks and blocks confidential it will be blocked.
data from being sent to unauthorized Tessian Enforcer tracks and blocks personal data health information such as health insurance or social
business accounts. from being sent to unauthorized business accounts. security numbers from being shared externally.

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH → 20

 Learn more about how Tessian
prevents data loss on email. REQUEST A DEMO →

Powered by machine learning, Tessian’s Human Layer Security technology

understands human behavior and relationships.

Certifications

Automatically detects and

prevents misdirected emails

CYBER ESSENTIALS CYBER ESSENTIALS ISO 27001 UKAS GARTNER COOL

CERTIFIED CERTIFIED PLUS VENDOR 2020

Automatically detects and Customers

prevents data exfiltration attempts

Automatically detects and

prevents spear phishing attacks
Share this report

A CEO’S GUIDE TO DATA PROTECTION AND COMPLIANCE TESSIAN.COM/RESEARCH →

TESSIAN.COM/RESEARCH →