What fintech companies need to know about the convergence of cybersecurity and data privacy

This article was first published by Benzinga.

As the world continues to digitize rapidly, and more and more issues around cybersecurity and data privacy come to the forefront, it’s no longer feasible to keep conversations around the two separate. 

Cyberattacks tend to be eye-catching and make flashy headlines. However, privacy violations and data compromises that accompany such intrusions are not as widely reported. Part of the reason is that most people don’t understand the importance of data privacy and how it’s tied to cybersecurity. 

It’s time to take a different approach to understanding how both cybersecurity and data privacy are interlinked. 

Fintech companies and financial institutions benefit from a partial exemption under state-level privacy laws (and in accordance with compliance with requirements like the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule and Privacy Rule). Nonetheless, the companies and institutions hold critical consumer data, and therefore must make efforts to understand the direct impacts their data practices have – for better or worse.

Numerous institutions such as the Federal Trade Commission (FTC), Consumer Financial Protection Bureau (CFPB), and Securities and Exchange Commission (SEC) are now starting to crack down on weak practices. Increasingly, laws and regulations are being introduced that no longer give companies a pass on poor cybersecurity and privacy practices. Companies that aren’t implementing sound measures to protect their users’ privacy are met with fines and disciplinary actions.

Part of the problem is that fintechs today don’t always have the best grasp on what critical data exists within their ecosystem and what they should be doing to protect it. As more financial institutions become increasingly digitized, it’s becoming harder to conceptualize and track the large quantities of information constantly flowing through systems. 

“Once a business has an understanding of its data ecosystem, it can start measuring the necessary privacy and the adequacy of its security around that data,” said Bhavesh Vadhani, global leader of cybersecurity, technology risk and privacy for the advisory, assurance and tax firm CohnReznick. “Historically, companies have addressed the latter without truly understanding the former.” 

As soon as data resides on enterprise systems, a connection between data privacy and cybersecurity is established. The business is now accountable for designing cybersecurity controls and programs that protect personal information from theft, unauthorized access, and damage.