Addressing data management, security and compliance for retailers

Why retail data security matters

In recent years, major retail brands have seen an increase in hacking and online theft due to an increase in shopper demand. This past year alone, ecommerce has grown over 36% according to the US Census Bureau. Retailers continue to be the prime target for cyber-attacks because they carry a high volume of personally identifiable information (PII) and payment card information (PCI), which, when stolen, can be sold to malicious actors through a myriad of dark web and black market sites. And while every industry is at risk, retail repeatedly tops security reports for those reasons. With the volume of breaches occurring, retailers need to pay extra attention to their security measures and make sure they are staying compliant with regulations like the Payment Card Industry Data Security Standard (PCI DSS).

Let’s take a closer look at how retail can better approach data security and address it to meet compliance regulations.

Implement a comprehensive data management strategy

Taking a holistic approach to data security is one of the most effective avenues to achieve compliance. Unless your organization is sharing customer data with a third party, your employees are the only people with access to your company's stock of data. Training employees across departments on proper handling and storage practises is a great first step to building a security strategy. Also consider hiring a data protection officer (DPO) or someone responsible for cybersecurity to give your organization another level of assurance that data safeguards are being implemented. 

Beyond managing people, your organization should also work to detect and remove unnecessary consumer data. It’s natural for your business to accrue and use it for targeted marketing efforts, payment processing and day to day functions, but be sure to cleanse your trove of data that has no business function or benefit to your consumers. 

Be prepared in the case of a data breach 

Unfortunately, with the growth of cybercrime, data breaches are not unique. In fact, cyber crime is expected to cost the world over 10 trillion dollars annually within the next four years. Develop protocols and policies for how your company will respond appropriately to the mishandling of sensitive information that results in exploitation. As with any crisis plan, representatives within each department should be trained on how to respond should a data breach occur. This response includes knowing how to safeguard untampered with data and understanding who to contact. Not only is it sometimes a compliance requirement to disclose when a breach occurs, it is generally a good practice to be transparent with employees and customers to salvage their trust. This fosters ongoing trust and proves to your consumers that your organization is transparent about the threat landscape. 

Have a deep understanding of PCI DSS and how to comply

PCI DSS compliance demonstrates that retailers have control over the payment card information they process and are taking the steps necessary to prevent customer data theft and fraud. One of the best ways to initiate a deep understanding is staying informed on the ever evolving PCI DSS landscape. 

Aside from wanting the best for your customer base and business itself, your organization also needs to recognize that it is required by law in many US states and European countries to comply with PCI DSS. Any retailer that isn’t currently in line with PCI needs to take immediate steps to do so.

Below are general guidelines to help your company meet compliance:

• Understand the regulations in place to uphold PCI DSS compliance
• Create and maintain a secure environment for your data to lie
• Regularly audit your company to see where data resides and what risks are present
• Take the actions necessary to remediate risk

Employ data discovery software

Protecting your customers and having the right data security measures is a lot easier with the help of technology. Ground Labs has developed solutions with the unique needs of the retail sector in mind such as Enterprise Recon PCI, which is even prepared to meet the expectations of PCI DSS 4.0. Our solutions can quickly and efficiently discover all sensitive data residing on your servers, as well as encrypt, mask, secure, and delete. 

Learn more about our solution Enterprise Recon PCI here, or schedule a conversation with a data discovery expert.