Strong Privacy Requires Strong Security - and GenAI Raises the Stakes

"But in the real world, this separation has become increasingly artificial. You cannot claim to protect someone's data if it isn't properly secured. And you cannot secure that data effectively if you don't understand the privacy obligations attached to it (i.e., who should access it, how long it should be retained, what jurisdictions it touches, or how it may be used)."

"True privacy protection isn't expressed in elegant policy language, it's about the technical, procedural, and cultural disciplines that make those policies real in daily operations. The Fundamentals Still Matter Despite the rapid evolution of technology and regulation, the fundamentals matter more than ever: Strong Identity and Access Management Ensuring only the right people have access to the right data at the right time and removing unnecessary access as roles change."

Privacy and security are inseparable responsibilities because protecting personal data requires both adequate security controls and a clear understanding of privacy obligations like access rights, retention periods, jurisdictions, and permitted uses. Organizations must align policy commitments with day-to-day technical, procedural, and cultural practices. Core disciplines include strong identity and access management to ensure appropriate access and timely privilege removal; basic security measures such as encryption, patching, multifactor authentication, log monitoring, and secure configuration; rapid breach detection, containment, recovery, and transparent communication; and disciplined data hygiene focused on classification and minimal retention.

Read at Securitymagazine