What Data Does Your Organization REALLY Need?
Your personal information is ‘out there.’ It has been shared with enough organizations throughout your lifetime that you can’t always protect your identity yourself. Take a couple minutes and think about whom you have shared your personal information with…doctor’s offices, dentists, schools, employers, banks, insurance companies, tax preparers and the list goes on. What are those organizations doing to protect your information? As careful as you are at protecting your identity, you have no control over what these other organizations are doing to protect your personal information.
Take a look from the other side of the table now and consider what you and your company are doing to protect employee and client information. Your company’s industry may have strict guidelines and regulations that mandate safeguards be put in place. Your company may have processes and procedures to mitigate the risk of losing this information. These processes and procedures should cover data collection, access controls, and data retention.
- Does your company need all of the personal information it is collecting? If not, why accept the additional risk of having this information?
- Is access to personal information limited to those who need it to do their jobs? This includes access to electronic records, and paper records.
- Is your company retaining personal information for a period longer than necessary, or in an unsecure format? If your company is not required to retain personal information and doesn’t need this information, don’t store it. If it does need this information, be sure it is stored safely and securely. This may mean encrypting electronic data.
- If your organization has policies and procedures in place, be sure to adhere to them. These policies and procedures are only as good as the people in your company. If your organization doesn’t have policies and procedures in place, take the initiative and suggest policies be drawn up. The American Institute of Certified Public Accountants is a good resource to begin your research on proven ways to protect personal information.
There is a great article in the Journal of Accountancy which goes into more specifics in these areas.
