icon

Compliance

10/25/2022 Compliance

“The California CPRA Privacy Law is Coming for You this January”

Does your company do any business with California residents or businesses? Do you have even one employee in California? Do you generate $25 million or more in gross revenue?  Are you a service provider or contractor for a California based company that is subject to the GDPR?

If so, you should know by now that in a mere 2 ½ months the “California Privacy Rights Act” (CPRA) enforcement will begin, and with it some much-expanded privacy rights of California residents, and some much-expanded privacy obligations for businesses. 

Background:

The CPRA is the most robust consumer privacy law in the United States. In November 2020, California voters approved the California Privacy Rights Act of 2020, otherwise known as the CPRA. This is an amendment to the California Consumer Privacy Act (CCPA) that voters approved in 2018. 

The CPRA has now modified, expanded, and clarified privacy rights for California residents, and it takes inspiration from the EU’s GDPR policy in a variety of ways. For instance, the CPRA creates a new enforcement agency. Previously the CCPA was enforced by the California Office of the Attorney General. However, in the EU, GDPR is enforced by data protection authorities –– and now, California has implemented one, too: the California Privacy Protection Agency (CPPA). 

Purpose:

CPRA’s purpose is to redefine and expand the California Consumer Privacy Act (CCPA) in order to strengthen the rights of residents of California. It provides consumers greater opportunity to opt out and requires deliberate data privacy management from businesses.

California has made it clear that they are serious. These rights can and will be enforced by private citizens, all California district attorneys, and the newly created “California Privacy Protection Agency” mentioned above and created solely to enforce privacy laws.

What are these rights?

The CPRA expands and amends the previous California privacy laws. Taken together they consist of the following bundle of privacy rights:

  1. Right to Access personal information.
  2. Right to Delete personal information.
  3. Right to Correct personal information.
  4. Right to Object to Selling personal information.
  5. Right to Opt-Out of behavioral profiling and automated decision making.
  6. Right to Object to the Use of Sensitive Information.
  7. Right to Data Portability.

But that’s not all:

  1. Purpose Limitation – Personal information can only be used for the purpose it was originally collected.
  2. Children’s Data – Fines are now tripled for violating the privacy rights of children under 16.
  3. Storage Limitation – Personal information must be destroyed once it has been used for its purpose at collection.
  4. *Reasonable Cybersecurity Controls – Security controls must be commensurate with the sensitivity of the data you are protecting. This part by itself is just as big an undertaking as complying with the rest of the CPRA.

What are the penalties? 

$2,000 per offense for mistakes, $2,500 per offense for negligent mistakes, and $7,500 per offense for intentional offenses.

Please be aware – These offenses are accumulative and every California resident impacted by the same event will constitute a separate offence.

This can mean fines well into the millions of dollars

So far, under the CCPA (the current main California Privacy law) there has been numerous private settlements reaching into the millions of dollars including a recent one for $10 million - and just this past August Sephora was fined $1.2 million by the California Attorney General.

Becoming compliant with the CPRA is not an easy task, you will need to find out where every bit of personal data comes from and how it is handled. Then you will need to figure out how to actually comply with the law which will take policies and procedures and technical implementations. We at Digital Edge are experts in compliance and can assist you in developing a strategy and plan to ensure your business is protected and align with the January 2023 deadlines.

For more information contact sales@digitaledge.net

 

6/17/2022 Compliance

Mandatory Manual Reviews and Audits – SSAE-18 SOC2 Requirements.

Digital Edge's Compliance team has noticed that organizations and IT/compliance groups lack understanding of mandates for scheduled reviews and audits.

Each cybersecurity standard or framework has its own unique requirements. This article provides information on minimal required reviews and audits by PCI standard.

6/15/2022 Compliance

Top Security Trends To Keep In Mind When Implementing New Technology

Suppose you’re implementing new technology to secure your business. Whether you’re updating your current system or looking for ways to support a hybrid or remote working model, you need to be aware of the top security trends.

So, which are the new security trends you need to be aware of when implementing new technology to protect your business?

Keep reading for a complete guide to the top security trends, from technologies that support hybrid working to technologies that ensure your system can keep up with the changing demands of the security landscape.

6/14/2022 Compliance

Mandatory Manual Reviews and Audits – PCI Requirements.

Digital Edge's Compliance team has noticed that organizations and IT/compliance groups lack understanding of mandates for scheduled reviews and audits.

Each cybersecurity standard or framework has its own unique requirements. This article provides information on minimal required reviews and audits by PCI standard.

 

 

6/14/2022 Compliance

Mandatory Manual Reviews and Audits – ISO 27001 Requirements.

Digital Edge's Compliance team has noticed that organizations and IT/compliance groups lack understanding of mandates for scheduled reviews and audits.

Each cybersecurity standard or framework has its own unique requirements. This article provides information on minimal required reviews and audits by NIST CSF standard.

6/14/2022 Compliance

Mandatory Manual Reviews and Audits – NIST CSF Requirements.

Digital Edge's Compliance team has noticed that organizations and IT/compliance groups lack understanding of mandates for scheduled reviews and audits.

Each cybersecurity standard or framework has its own unique requirements. This article provides information on minimal required reviews and audits by NIST CSF standard.

6/14/2022 Compliance

Mandatory Manual Reviews and Audits – HITRUST Requirements.

Digital Edge's Compliance team has noticed that organizations and IT/compliance groups lack understanding of mandates for scheduled reviews and audits.

Each cybersecurity standard or framework has its own unique requirements. This article provides information on minimal required reviews and audits by HITRUST standard.

 

5/20/2022 Compliance

FundCount has partnered with Digital Edge in the AWS realm to provide a wide range of DevOps and SysOps services

FundCount has partnered with Digital Edge in the AWS realm to provide a wide range of DevOps and SysOps services to FundCount SaaS clients. Digital Edge successfully collaborated with FundCount to architect, deploy, and support the award-winning Accounting, Analysis, and Reporting software hosted on AWS.

4/25/2022 Compliance

The GDPR Jurisdiction Rule You Probably Don’t Know About

If your company is based in the EU, then the question of whether the GDPR applies to you is easy; it does.

But that is not all. 

4/7/2022 Compliance

HITRUST Certification

Why HITRUST?  

HITRUST develops risk and compliance management frameworks, assessment, and assurance methodologies, maintains them, and provides access to them, being in collaboration with the leaders of information security and risk management, both from the public and private sectors. HITRUST aims to fill the gaps still not addressed by some regulations.

HITRUST Common Security Framework addresses security, privacy, and regulatory challenges organizations face. HITRUST includes and cross-references numerous globally recognized standards, follows a risk-based approach, and creates the options for a well-orchestrated unified method of managing data protection compliance. This makes HITRUST highly beneficial for those organizations seeking to safeguard the data, but this also makes HITRUST not easily implementable for those businesses that still require staff training and bringing all the processes to higher standards to implement HITRUST. Digital Edge is the right partner in achieving this goal.

Let's talk: +1 (718)-370-3353

Speak to a specialist