Prashanth GJ, CEO, TechnoBind Solutions
The mandatory implementation of SEBI’s Cloud Service Adoption Framework brings data compliance into focus for industry leaders.
Data compliance has gained momentum worldwide, India included, with digital transformation acting as its catalyst. As limitless data is being generated through multiple endpoints, a gateway has been left open between our devices and the outside world. A survey published by IDC in January 2023 shows 48% of the respondents say that data sovereignty and industry compliance have factored highly in discussions about their future IT architectures. Thankfully, the Securities and Exchange Board of India’s (SEBI) new framework on cloud service adoption and data compliance to help Regulated Entities (RE) is what the economy and digital India needs as a guiding stick.
Why is the framework necessary?
Data compliance is in focus, specifically in a post-pandemic digitally transformed environment due to the constantly looming cybersecurity threats, loss of data privacy and misuse of data collected. A Cloud Security Alliance (CSA) survey released on October 2022 said that 92% of the respondents experienced cloud data breaches in 2022 and only 4% claimed their security to be 100% sufficient. The survey shows that 58% of the targets comprised third parties, contractors and suppliers. While companies know who their direct CSPs (Cloud Service Providers) are, they draw a blank when secondary and tertiary CSPs are involved in the background. Wherever the cloud storage is located, the CSPs need to accept the law of the land, which might not be in the best interest of their customers based from a different region. As data is the window to privileged information SEBI’s new framework says the cloud should reside and be processed within the legal boundaries of India and the CSPs will work only in a fiduciary capacity. The bigger question now is are the leadership teams of organizations ready for such change in the cloud service adoption framework?
Cutting-edge technology tools for data management vital for the transition
The first phase of moving towards adopting strong data compliance is with the help of a robust end-to-end data management strategy. It involves managing data throughout its entire lifecycle, from acquisition to retirement. This is a critical need for CSPs who wish to qualify in meeting the requirement of SEBI’s framework. With this strategy companies can achieve:
- Comprehensive data governance
- Improved data quality
- Enhanced data security
- Increased efficiency and productivity
- Better data integration and interoperability
The end-to-end data management strategy is a pentagram having Access, Management, Security, Infrastructure and Cloud as key points to help organizations manage a gamut of responsibilities around data. In the face of data compliance, these factors help provide stronger and deeper benefits for operations:
Access: This is instrumental in achieving the data compliance framework of the land as it helps safeguard personal data, enforce privacy regulations, manage user consent, and facilitate auditing and accountability within organizations. Role-Based Access Control (RBAC) is commonly used in compliance with data protection regulations. Audit trails and logging, data encryption, consent management and data subject rights are all key elements in helping companies with compliance.
Management: By implementing comprehensive data governance frameworks, robust security measures, and proper data classification and retention policies, organizations can minimize the risk of non-compliance and demonstrate their commitment to protecting data privacy and security. Effective data management practices help organizations meet their compliance obligations and mitigate the risk of regulatory penalties.
Security: Compliance regulations often require the use of encryption to safeguard personal data. Mechanisms such as checksums, digital signatures, and integrity controls help detect and prevent unauthorized modifications or tampering of data. Incident response is an aid under security measures to ensure adherence to regulation. Unnecessary data can be securely disposed and only necessary data can be stored as part of data compliance. With security being a part of the data compliance framework, the safety net also extends to 3rd party vendors or service providers.
Infrastructure: Data infrastructure forms the foundation for data compliance efforts by providing the necessary tools, processes, and controls to manage data securely, ensure privacy, meet regulatory obligations and ensure data governance.
Cloud: This is by far the most integral part of data compliance. The cloud has gained importance not just because of the ease of data storage and management with the added benefit of cost-effective operations; it is also because the CSPs have a stringent data compliance policy of their own. By using cloud, companies can achieve the benefits of robust access, management, security and infrastructure as a single entity and not separate measures. SEBI’s framework is only helping REs and businesses in strengthening the data compliance component.
As SEBI has provided a 12-month window for the framework to be implemented this has been a hot topic of discussion in board meetings. A survey by a data security platform company says, 66% of the organizations have increased their security budgets by 41%. This change is occurring slowly but increasingly because C-Suite leaders are making data compliance their priority. But there is a need for every leadership team to make data compliance their top priority and not just a mechanism to just avoid legal disputes. The framework is built to counter any challenges authorities may face during a crisis and has been brought into focus to ensure that the ownership of the data and protection would reside within the reach of the Indian government. This framework is a crucial addition to the existing guidelines on cloud computing and is designed to help implement secure and compliant cloud adoption practices. Companies with cutting-edge brands spanning Access, Management, Security, Infrastructure and Cloud portfolios will help bridge the gaps between CSPs and REs when implementing the framework. Travelling in this path will lead businesses in India to a new beginning with a safe, secure, accessible and dependable data management strategy.
