Minimum Steps for Real Data Protection: Not Just Cybersec...

Let’s make it simple: data protection is not just a technical issue. It’s not just a cybersecurity checklist or something the IT guy takes care of while the rest of the company keeps moving as usual. It’s a shared responsibility — legal, managerial, and human.

And it starts long before any firewall kicks in. It starts with knowing yourself, because data protection touches every part of your organization. It’s not standard. It’s not generic. It’s tailored.

I’ve seen small shops using privacy disclaimers copied from an airline company. I asked why. The owner told me, “Well, it was from a big company, so I figured it had to be complete.” So this small retail business was trying to protect the confidentiality of special meals for Jewish, Muslim, and vegetarian passengers. That’s how far misunderstanding can go.

First: understand what you collect. Not just vaguely — precisely. What kind of data do you ask for? What data do you receive without asking? What data are you storing by default, just because a system logs it?

Second: know why you collect it. If you can’t explain in one sentence why a specific piece of personal data is necessary, you probably shouldn’t be collecting it.

Third: map your data flows. Where does the data go once collected? Who touches it, which systems process it, where is it stored, and when is it deleted? Most companies don’t know. That’s not ignorance. That’s negligence.

Fourth: set real access rules. Not everyone in your organization needs access to everything. Limit permissions. Monitor access. Document who sees what, and why.

Fifth: write it down. Keep a record of your processing activities. Not for the regulators — for yourself. You can’t protect what you don’t understand. And remember: that data was entrusted to you for specific purposes. If your business partner or a former employee leaves and starts calling your clients, it means you failed to protect their data. That’s on you. If your secretary has her laptop stolen, and it contains the customer mailing list, that’s your responsibility. Understanding this helps you improve management, tighten processes, reduce unnecessary data flows, and maybe you'll avoid collecting useless information in the first place.

Then come the basics: strong passwords, encryption, and multi-factor authentication. But they only protect the gate. If what’s inside is a mess, you’re just locking the door on chaos.

But you also need to give clear instructions to everyone. That means having written assignments and internal mandates that define who is allowed to handle what, based on their actual job. Do HR employees really need access to the bank account where salaries are deposited? Do admin assistants need to know what’s in the contracts, or whether Mrs. Smith orders beef or salmon? If they don’t need that data to do their job, they shouldn’t have it. Period.

Also, stop hiding behind cybersecurity. Protecting systems isn’t the same as protecting people. Data protection means using personal information only for the reason you collected it, and not for more. It means not reselling it. Not combining it silently with other sources. Not feeding it into AI without clear consent.

In the European Union, this is the law. And it has consequences. Fines are real. Complaints happen. Reputational damage can come from a single email sent to the wrong person. One file leaked. One “unsubscribe” button that doesn’t work.

But beyond the EU, it’s becoming a standard. Whether you’re in San Francisco, Toronto, or Singapore, the digital world is aligning. Even if your country doesn’t require full GDPR-level compliance, your clients or users might.

So start here. Start now. Data protection is not a theoretical principle or a paragraph in your privacy policy. It’s a discipline, and this discipline means your action gains Digital Trust.

Tags: #GDPR Compliance, #Data Privacy Matters, #AI Regulation, #Tech Responsibility, #Digital Risk

Gianni Dell’Aiuto is an Italian attorney with over 35 years of experience in legal risk management, data protection, and digital ethics. Based in Rome and proudly Tuscan, he advises businesses globally on regulations like the GDPR, AI Act, and NIS2. An author and frequent commentator on legal innovation, he helps companies turn compliance into a competitive edge while promoting digital responsibility. Click here for more information on his website

Editor: Wendy S Huffman