PDPA: Need for mandatory data breach notification; SMBs vulnerable
- Govt must recollect obligatory breach notification an crucial part of any facts protection legislation
- Cybercriminals know that SMBs make less difficult targets, and also positioned their partners’ facts at hazard
IN nowadays’s digital economic system, the personal information of customers has grow to be a wealthy source of facts for agencies searching for to better cope with the needs in their customers, whether or not that is within the form of better targeted marketing, or services tailored to the desires of precise clients.
With the creation of the Personal Data Protection Act (PDPA), Malaysia identified that because the custodian of so much consumer records, groups and companies additionally have obligations to their clients to make certain that the data they keep is correct, and correctly blanketed.
With Malaysia’s Personal Data Protection Act entering force on Jan 1, 2013, we advocate searching into two key regions -- SMB (small and medium enterprise) readiness and mandatory information breach notification.
Threat to SMBs
While global multinationals have had numerous experience in this vicinity, because of similar legislation inside the United States and Europe, for a few of the nearby smaller businesses in Malaysia, this is a brand new frontier.
With the fast adoption of IT to enhance the client revel in, through web portals or affinity and membership applications, these establishments have also collected a multitude of private information approximately their clients, and these days share comparable responsibilities underneath the PDPA.
SMBs are an crucial a part of Malaysia’s economic system. They constitute 99.2% of the whole range of enterprise establishments in Malaysia, make contributions approximately 32% of the Gross Domestic Product (GDP) and 59% of overall employment.
Beyond this, SMBs are a vital a part of the ecosystems as partners of establishment organizations (MNCs) which do business in Malaysia.
However, it's also an increasing number of obvious that MNCs see a hazard in doing commercial enterprise with companions who are not able to guard the sensitive data being shared with them. In 2011, 18% of all targeted cyber-attacks globally have been on companies with 250 personnel or fewer.
In the first 1/2 of 2012, Symantec noticed this percent double to 36% (click on to amplify photo). Cybercriminals recognize that due to the decrease protection posture of SMBs, they're lots easier objectives, and could also have information (their personal or partners’ client statistics, or intellectual property) which may be stolen and monetized.
In addition, compromised structures of SMBs also are used as stepping stones into the structures of their business partners.
It is hence critical that SMBs recognize the exposure they need to cyber-assaults, and the viable damage to their organizations, through loss of reputation, enterprise, or even criminal censure, inside the case where cybercriminals are able to scouse borrow statistics from inadequately covered structures.
Mandatory information breach notification
In the greater than years since the enactment of the Personal Data Protection Act in Malaysia, the cybersecurity risk panorama has multiplied in complexity and scale. News of massive scale breaches of corporations’ databases has been a consistent, or even the biggest and satisfactory protected structures have not been spared.
It is for this reason timely for the Government to additionally recollect the advent of mandatory breach notification in the PDPA. This might be in line with many different jurisdictions which have either carried out such legislation or are in the process of doing so.
Mandatory breach notification is an vital a part of any statistics safety legislation because it offers a definitive course of action to agencies of what have to be accomplished inside the case of a statistics breach.
By informing affected stakeholders, this additionally offers them the opportunity to take the required remedial movements (such as changing passwords, or having their economic establishments change their credit card numbers) to mitigate the effects of the breach.
While it is recognized that this will increase the regulatory overheads of the PDPA, and constitute an accelerated burden on businesses, the resulting improved patron self assurance in the data protection regime in addition to e-trade can handiest be helpful to Malaysia as it movements towards growing its own digital economy.
Ng Kai Koon is senior supervisor of Government Affairs, Asia Pacific and Japan, at Symantec Corporation
Related Stories:
PDPA: Businesses have duties and burdens
The coming of the Personal Data Protection Act
Clock ticking for Personal Data Protection Act compliance
The story of two legal guidelines: Section 114A and the PDPA
For more era news and the present day updates, follow @dnewsasia on Twitter or Like us on Facebook.