By Chris Green, OSCP, CISSP, CISA, CRISC, QSA/PCIP, CMMC RP, Structured Manager of Penetration Testing —
People are better at protecting their personal data than they realize. Phones lock automatically, apps ask for permission before tracking location, password managers alert when credentials get reused, and ads feel uncomfortably specific. We’ve all experienced at least one moment of “wait, how did it know that?”
That awareness has turned personal data privacy into muscle memory. People may not read every privacy notice, but they understand the risk. They lock devices, think twice before clicking strange links, and know oversharing can come back to bite them.
Then they log in to work.
Suddenly, many of those instincts fade. Files get shared “just in case,” permissions are granted broadly because it is faster, and sensitive documents live in shared folders with names like “Misc” or “Final_Final_v3.” Collaboration tools blur the line between convenience and control. Data moves quickly, and nobody stops to ask whether it should. This is where data privacy in the enterprise starts to break down.
At a personal level, people understand that not everyone needs access to everything. You wouldn’t hand your unlocked phone to a stranger and walk away. In many organizations, the digital equivalent happens every day. Access is granted once and rarely revisited. Roles change, contractors come and go, and systems pile up. The original reason for access disappears, but the access remains. It’s usually not malicious. Work moves fast, and privacy feels like something that lives in policy documents rather than daily decisions.
The problem is that regulators, customers, and attackers don’t care why the data was exposed. They care that it was.
Personal devices offer an interesting contrast. Phones make data collection visible. Fitness trackers show activity history. Location services display where you have been. Ad settings reveal why certain content appears. You may not like what you see, but at least you can see it. Unfortunately, many organizations can’t say the same about their own data.
Ask a simple question like “Where does our sensitive data live?” and the answer often turns into a discussion rather than a list. Files sit in email inboxes, shared drives, cloud platforms, ticketing systems, and vendor portals. Copies exist because copying is easy and retention occurs by accident rather than design.
Ask who has access, and things get even murkier. Access rights may technically exist, but no one’s looked at them recently. Privileged access accumulates quietly. Temporary access becomes permanent. Service accounts outlive the services they were created for.
Retention is often the hardest question of all. Data that no longer serves a business purpose still exists because deleting it feels risky. Ironically, keeping unnecessary data is often what creates the risk in the first place.
This lack of visibility is where privacy programs struggle. You can’t protect what you can’t see, and you can’t manage what you do not understand.
Strong data privacy isn’t about perfection. It’s about awareness and discipline. The same principles that guide personal data hygiene apply at scale. Know what you have, limit who can access it, remove what you no longer need, and check periodically to make sure the rules still make sense.
Organizations that do this well tend to approach privacy as an operational practice rather than a compliance checkbox. They invest time in understanding their data flows, define ownership instead of assuming IT owns everything, and test whether access controls align with how people actually work.
This is where structured governance makes a real difference. Not governance as in binders on shelves, but governance as in repeatable habits. Regular access reviews catch issues before they become incidents. Data inventories replace guesswork with clarity. Policies are written to support reality rather than fight it.
When privacy incidents occur, they are often traced back to small, ordinary decisions. A shared folder that grew over time. A vendor that was onboarded quickly and never reviewed again. A system that no one wanted to touch because it was “working fine.” These aren’t exotic failures. They are human ones.
During Data Privacy Week, it is tempting to focus on laws, fines, and headlines. Those matter, but they are outcomes, not causes. The cause is usually a gap between what people know instinctively and what organizations practice consistently. People already understand privacy. They just need systems that support good behavior instead of undermining it.
The organizations that succeed aren’t the ones with the most tools. They are the ones with visibility into their data and the discipline to act on what they see. They treat privacy as part of everyday operations, not as a once-a-year exercise. Much like the muscle memory developed to protect their personal data, mature organizations build privacy into daily workflows until it becomes automatic.
Sustainable data privacy depends on more than awareness or good intentions. Regular assessments and control reviews provide clarity into what’s working, what’s drifted, and where risk has quietly accumulated. These exercises turn privacy from a static requirement into an active risk management practice to better protect staff, customers, brand reputation, and the bottom line.
About the Author
Chris Green is an experienced cybersecurity professional with over a decade in the field, focusing on offensive security, risk assessment, and compliance. As a Manager of Penetration Testing, Chris leads a team of testers in identifying and mitigating security vulnerabilities across complex environments. His expertise spans network and web application penetration testing, phishing and social engineering engagements, and PCI DSS compliance assessments as a Qualified Security Assessor (QSA).
Chris holds several certifications, including the OffSec Offensive Security Certified Professional (OSCP), ISC2 Certified Information Systems Security Professional (CISSP), ISACA Certified Information Systems Auditor (CISA), and Certified in Risk and Information Systems Control (CRISC), and more, demonstrating his ability to perform thorough penetration tests, audit a variety of environments against compliance standards, and manage and assess IT risks. In addition to hands-on technical skills, he provides virtual CISO services, guiding organizations in aligning security strategies with business objectives.