Data protection vs data security vs data privacy – what is the difference?

With all the different jargon out there it can be difficult to keep the various terms straight in your head. To further complicate matters, many of them are used interchangeably when in fact they usually do mean separate and distinctly different things. We all know how important it is today to ensure our data is protected, private and secure.

We take a look at what these particular classifications mean, where they overlap and differ, and a few examples of how and when you should be ensuring they are in place.

Data protection is your last line of defence, the process by which you protect your data by backing it up and recovering it so that it is not lost. Information can be corrupted, compromised, or have any number of things happen so it is essential to be prepared for any eventuality. With data protection, if something does occur you have the ability to restore your files back to their original unblemished state. There are record amounts of data being produced each year with no likelihood that this will slow, and with everything, you could ever want or need to be stored somewhere it is so important to make sure it is safe in the first place, and that you can still access it when you have to or just want to.

You can manage your data through lifecycle management, which automatically backs up and moves data to on or offline storage. The other key component, data availability, is the crucial component that allows you and your employees to still be able to have access to the data you need to do your job no matter what happens, even if the data has been corrupted or damaged. Using cloud backup, storage snapshots and continuous data protection means that you will always have a clean copy for your purposes in any eventuality.

Based more on the idea that your information could well be under threat from internal or external malicious parties, data security is designed to stop attacks, defend your system and organisation so that all of your data remains secure. Normally made up of several levels of defences, so that even if one is breached there are further barriers between your information and those you don’t wish to access it, data security is becoming more and more of a priority as we see every day. Whether for personal, corporate, or political ends, hacking is a real hazard in today’s world and must be safeguarded against.

It also protects against internal issues, human error, and other areas which remain key causes of data loss, corruption, or theft. Not just for cybercriminals, data security should keep your entire system safe using tools and protections like encryption, redacting sensitive information, and masking certain data. There is really no such thing as too much security so it is worth looking at all the ways you can utilise these processes for your own business.

Finally, we come to data privacy, one of the most contentious and key areas when it comes to keeping information safe. This is the determination process used to decide if any third parties can have access to your data, and can be put in place by an organisation or individual. Private data cannot be shared with anyone who is not authorised to see it but this does not necessarily make it secure. You must make your data safe by using the above data security tools and keep it private by preventing unauthorised access and controlling who exactly can use and see certain data within your computer system.

Many different regulations like HIPAA, GDPR and the Payment Card Industry Data Security Standard exist to build data privacy standards that must be met by all companies and organisations. Who is allowed to see what, like medical records, bank accounts, and the myriad other personal and private information out there, and how to stop those who are not, is one of the biggest challenges in the 21^st century for lawmakers, regulatory bodies, and individuals alike. Only by utilising the right level of data security and protection can you really enforce who can actually see what, and keep the information you need private.

When you do have a store of personal data that must be kept private there are certain points you must hit to abide by the going regulations and show compliance:

• Personal data must be processed lawfully
• It must be collected and stored for a specific purpose
• It must only be stored as long as is needed for that purpose
• It should be limited to only what is needed
• It should be accurate and up to date at all times
• It must be protected against deliberate or accidental loss, damage, destruction, and unlawful access or processing

The latter is where all of these terms come together, as the controller must be able to show compliance with these through the correct tools and technical or organisational measures to demonstrate that this information is being secured.