Name: How to Align Data Governance, Compliance and Data Security (Europe & Middle East)
Uploaded: 2026-01-21T10:51:03.731Z
Duration: 35 min 8 s
Description: How to Align Data Governance, Compliance and Data Security (Europe & Middle East)

Transcript for "How to Align Data Governance, Compliance and Data Security (Europe & Middle East)": Hi everyone. Thanks for joining us today. My name is Nick Cavides. I'm field CTO here at Forcepoint for Asia Pacific. And today I'm joined by Michael Leach, one of my colleagues from The United States. Today we're talking about a very big and broad topic, and that is how do we align data governance compliance and data security, particularly in this new era of artificial intelligence, increased regulation and, a real push for innovation. And I'll let Michael introduce himself, but I'll make some opening remarks about what I'm seeing here where I'm based in Australia and across Asia Pacific. What I see today is organizations across the entire spectrum from small companies to very large companies, all concerned on how are they going to comply with the increased regulatory obligations they have around data security? You've got the whole C suite, whether it's security, whether it's your data officer, whether it's your CIO or your CFO, all concerned with different aspects of data security. And now we have regulators that have moved from an education phase to more of an enforcement phase, dishing out fines and really coming down hard on organizations that they feel aren't really pulling their weight when it comes to data security. So with that, opening setting, I'd like to ask Michael to introduce himself and we'll get started on this discussion. Thanks Nick. I'm Michael Leach and I am in the ForceBoard and Global Director for Compliance and Legal here. Basically exactly what you're talking about is my day to day dealing with these regulations for our global operations and basically it's not just how to keep our customers compliant from the use of our tool, but how do we stay compliant. Everybody shares this issue, if you will, across the globe. I think a lot of us got our attention caught, matter what industry and corporate, when GDPR came onto the scene quite some time ago. That was kind of the first we saw from a kind of jurisdictional, basically, and a specific category of data now being regulated that typically was not heavily regulated before. Basically, it's persistent across no matter the industry, no matter the business and the services you provide, everybody's got it, right? You can't send an email without sending personal data. But as GDPR has come on the scene, and I think we are learning now in today's digital world, data is the new oil effectively. So more regulations are coming up around that commodity, as you will, to regulate it. And that is growing well beyond just data protection, data security, privacy. You now have the EU AI Act, you have basically like the EU Data Portability Act, you have a lot of global and regional regulations coming into play. As a global corporate player, much like government player, how do you keep up with all of that? Right? That's what's I think traditionally, we've always, you know, the cybersecurity company, we've always focused in our conversations with CISOs of our customers, you know, where the security is. But I think as you're hearing, that regulatory regime is now growing across the C suite, across the operations, fully across the companies. Just not about data security. It's about being compliant and secure in today's world. Yeah. And Michael, firstly, thank you for your work here at Forcepoint because it's really important that we actually practice what we preach and we do maintain compliance internally, with all of the regulations that we have to deal with. And we operate across many markets. We operate all over the world. I for myself, I cover all the way from India to Japan and everywhere in between here in Asia Pacific. You're very right in the rise of regulation. A lot of people only really got their taste of these types of rules with GDPR, which was unique at the time because it was extra territorial. It was applying the EU data no matter where it went, no matter who was holding it. And now we're seeing those same principles flow out of Europe and into other markets, particularly here in Asia Pacific where, you know, where I work, where it's kind of leapfrogged, where they were that, you know, many countries in this part of the world had rudimentary regulations, privacy policies, some guidance, very, very threat focused cyber security rules. To your point, in the same way that we used to talk just to the CISOs and security people, much of the regulation around cyber was based around threat protection. And now this evolving sort of regulatory scheme has moved from that into being far more data centric. A lot of it has been modeled, on Europe and I, on your European GDPR and they kind of leapfrogging ahead in some, in some ways. I have to, just in my job, when I go talk to people, I have to be credible. So I have to spend a lot of time doing research and making sure I'm up to date across all of these regulations. So I can go and talk to people about them. And it's hard, you know, I just had to familiarize myself with the, you know, all of the new regulations that have come in India, all the, the, DP DPA, in India, PDPA, Singapore PDPA, Japan APPI. I'm running out of letters to use in acronyms. It is definitely not getting less, it is getting more again, you know, it's that new commodity and the regulations are going to come around to basically provide that residency, that sovereignty around it. Some of these regulations are doing that outside of just data protection and privacy as well. Then you have portability from just a consumer in the digital world today, You want control of your data. A lot of these regulations are like privacy, very much arming you as the individual, the consumer out there to do that. And of course, like you're saying, we, at Forcepoint, we had learned this for ourselves to be compliant. And as we saw that, working within the company, we also made sure we'd translate that into our products. Well, as we saw this coming up more for ourselves, we also understood our customers need this as well. So that's where we started looking beyond just the security paradigm and started looking at the bigger picture here from a compliance regulatory landscape. How do our customers keep up with us? Kind of like what we had to learn for ourselves. So less the tools that we were looking at, why don't we basically do this and put it to the market and bring it to our customers as well? A lot of that comes from a very basic understanding. Data governance. Having a good, solid data governance program as your foundation within a company begins to set your ability to basically get ahead of this. Data governance is kind of a broad understanding in itself. But very much it starts with identifying the data that you have within your networks, right? Understanding where and what it is, is the first step to know what I have, is it regulated? How is it regulated? As soon as you identify the data you have, you can instantly begin securing that data. That's the other pillar from a data governance perspective that comes into play in my opinion. As soon as you know what you have, where it's at, you can start ring fencing and securing that data. As you work through all of these new regulations, what impacts you as an industry, as a service, what you're doing in the day to day operation of your company, what regulations align to that data that you now have identified in there. This gives you the ability to go from a good data governance, knowing what you have, knowing that it's secure, it gives you a lead and a start there to begin aligning that data to these separate individual regulatory requirements that can be had on the same data types even, okay? To where in some scenarios you're going have to do this with that data and other scenarios for other regulations, you're going to basically have additional requirements that you're going have to look at as well. And, you know, I think you raised some fantastic points there. Data governance, you know, I chuckled a little bit when you said it's broad because I don't think anything could be broader. It's such a very, very big area. And every time I talk to someone, depending on their previous experience and what they've done, data governance means something different to them. Because they've come from, it's all about managing my life cycle of this data or it's managing who's got access to this data. They all see it through a particular lens, but it's a much, much bigger area. How do you see people tackling that data governance problem? And what are the key things that you see that we have to do here at Forcepoint to make sure that program, the data governance piece before we move on to sort of the classification and security pieces, what forms a critical part of that data governance piece? Because I think that's what a lot of the people I talk to, they seem to be confused about because as I said, they're thinking about it from a particular point of view that they've had historically. That's exactly right. I've had those, I see what you're seeing from my day to day, from everybody I interact with outside firms and other customers, but I have those conversations internally as well. Is a lot of what I would call broad general definition and understandings around data governance. And the best analogy I can give you is when I stepped into the company, right? And that was kind of pre GDPR. And back in that day, data governance in the company was about basically data stewardship and data retention from a business record keeping and life cycle, like you said, okay? That was data governance, okay? That is definitely not. That's kind of the easy itch to scratch But these things, even then, you still have to, you have retention timing requirements for certain business records. Well, what are those business records? Well, you go back to, you need to know what data you have in hand, okay? But the base foundation for any good data governance is understanding what do I have to speak to in form of legal operation of my company, the regulations, the data I hold, the data I process and serve up from a customer and or just as a service. So that is kind of where it begins, is understanding what you have and understanding it's not just a CISO issue. It's not just a CIO issue. Okay? Absolutely. It's not a CISO issue, right? It's not just dealing with the CISO, it's not just dealing with security. It's your, you have to cut across the business. This is fundamentally a business problem. And, one of the pieces of advice that I give, really is that if you have to have buy in from those stakeholders and they have to take it seriously and half of the challenge is explaining to them what their actual obligations are and to take those obligations seriously. And you know, because often it's Oh, well, you know, let, let, we can deal with that. Someone else can deal with that. That's a security problem. You can provide some protective controls around that and that makes this problem go away from me, but that's not the, not the real world that we live in anymore. And that's not what the regulation, the spirit of the regulation is. And, know, we've even seen, here in Australia, we've had a really high profile case just recently that established some precedent where a company, had a data breach and they were notified of it by, they suspected it, but they didn't report it in a timely manner. Once they did report it, they didn't take the response as seriously as they should. And then they didn't have the protective controls and the regulator took them court over this and said, have violated these following parts of the principle. You, the old legislation before they made it tighter, this is on the old stuff before they've made it tighter, they've taken them to the federal court and they were issued a 5,800,000 fine and they were called out to say: You didn't take it seriously. You didn't notify us in time. You didn't have the protective controls that we would expect of an organization of your class. So comparing them to their peers. So therefore you are going to pay a $5,800,000 fine and 1,600,000.0 of that is specifically for not taking this issue in the, tealing this issue in the manner that we thought was appropriate. Now that makes everyone sort of go, wow, these problems, this is not just a security problem. It's a business problem because we had people in the organization who thought this is not, you know, this is an IT issue. You go deal with that. Go put some controls around this, go fix it. And that's not the view that the federal court took. That commodity is data, right? And that's where you're seeing these government and they're doing these heavy fines when they do have that case example to apply. They're definitely doing it. They want it doesn't matter the industry you're in. Everybody holds data. They want and they understand commodity it is and how it should be secured. It's kind of like, are you going to leave the vault open sitting with gold in it? No, that's the same concept in today's world, right? That it's not just within systems, it's flowing, it's our economy now, it's a global digital economy. So basically, they're making examples out of those who basically, and why they're bringing these regulations in, is telling business, you need to get better about securing that data. That is our economy from a moving forward perspective, regardless of what you're serving. Absolutely. And importantly, you have to know what you've got in order to actually do that. If you don't know what you've got, how are you supposed to effectively risk? Understand your risk and then how are you supposed to effectively control that risk? If you do not understand what you've got or where it is, it's a fundamental problem. You have to do that in order to do those other pieces. And, how do you see that here at Fools? I mean, this is a, we do this for a living. We know what sort of data we are collecting and holding because this is our bread and butter. And it's, I imagine it's still a challenge for us even as an organization to achieve that. We've built, as you said, we've built these tools to help us and now we're taking these into our customers. Yeah, I mean, that's the understanding too, once you have the basis set up, it doesn't stop there, right? It's an evolving landscape. We just mentioned that earlier. It's not less, it's getting more. We're going to see more of this. So how do we look at it from ourselves? You just said it, you've to know what you have to begin with. You have to identify that data. And then the other point, which we haven't really touched on yet, is like, where is that data? I went back to that digital economy that's flowing transparently to all of us in the day to day, per the use of systems, applications, services, cloud services, etc. Data is flowing everywhere, all the technology involved. That is creating a huge where is it at any given moment in time? What is it as it's flowing in motion? How do you stay on top of that? A lot of it has to come down to properly classifying and identifying that data, as we mentioned a moment ago. It's one of the basic initial pillars of setting up a good data governance program. Once you identify and tag that data, I've got PII here, I've got government controlled information here, whatever it may be from a contextual and regulatory requirement around that data type, if you will. You need to identify that. But then it's a matter of where is it located? We're global corporations today. Even when you're just a state based company, you're still utilizing cloud based services happening around the globe. So you may think you're fine because I'm not a global player. Well, that doesn't mean your data is staying globally for the services and the systems that you're using. That's another consideration, technology that's coming in. So that's where you need to understand what I have, where it's at, those are the basics before you can go to that next pillar, which is: now I need to be able to secure what I know I have. Okay? And quickly. And in motion, not just at storage, once it sits there, then I'll secure. No, it's got to be secured in transit, in process, in storage. These regulations require it. Okay? So how do you get ahead of that? It's an understanding. It's setting up these base pillars from a data governance program in order to do that, starting with that classification, going to the security, then aligning what am I in scope of? From a business activity and services, what regulations apply to me? Pretty much data protection and privacy, Victor, Flavour, GDPR, India, Singapore, Thailand, all of the ones you named everybody has a data protection and privacy program of some type, some of them extra jurisdictional, they follow the national, they don't follow your company business activity, they follow the person. Okay? Yes, they follow the person. I mean, how do you keep up with that? It's got to be very cognizant of who, what, when and where. All of those paradigms are what we just described right there. Okay? Then you have to basically begin, okay, how do I get ahead of this? How do I stay ahead of this? Okay? That's where basically you're looking at aligning the data to the regulation. What does that mean? Policies on that data. My regulation requires me this, I can put that into an automated policy within a system or a tool to basically say, hey, I've tagged this metadata, it's PII, it's EU National from a sourcing and in collection, HDDPR is the regulation that's going apply here. I've got another office location out in India. I've got my IDDPA that's applying here from a DNA data protection locality on that national data. As they move across the world, their data follows them, their communications, their emails they're sending, all of these requirements still need to be met. Identify it, locate it, secure it, align it by policy to your regulations, apply those policies, now you've got a good data governance construct program in place to create a standard to build off of at that point in time. But it really doesn't stop there. Everybody's creating data, every day. It's continuous, right? You can't do a snapshot in time and say, yeah, we did a data audit, right? And it was fine six months ago, so it's going to be fine today. It has to be continuous and we're creating more data than ever before and at a faster pace than ever before. And now it's not just people who are creating data and data that's coming out of regular systems. We now have these generative AI tools, that are generating sensitive data in reality because they're often tasked with. Give me something out of, you know, perform some analysis for this, perform some analysis of that and then bring me something back and that something back generally is high value. Mean, otherwise why would you use the tools? And they're creating, you know, we're now creating this, this, data at an unprecedented rate. Now what you've just said is, it sounds like to me a very, very big undertaking for any organisation to achieve. And know what I'm understanding? Absolutely. I mean, and when I started here and, you know, we didn't have generative AI you know, when I started with the corporates and then having to deal with this and contend with this, right? And data governance overall. So how did you do it? It was massive resources, heavy manual efforts, very localized, having to bring that up into the global understanding from those localized, it's a heavy burden and undertaking. And that's just to go, who and what? How do you basically get ahead of it and then begin managing it? Well, you hire hundreds of people. Obviously, that's the answer, right? I think the answer is in the problem that we're presenting in itself. Generative AI coming into the state, artificial intelligence. We talked about technology, creating data sprawl. AI is just going to exacerbate that enormously for everybody, okay? It's not just about cloud services, it's interconnected generative AI, all the models that it's connecting to underneath, all the services driving that, all of the flow of that globally, process it, to serve it right back up. The sprawl is increasing heavily and transparently. You're not seeing every action that AI is doing, everything it's touching and how it's using it. It's going to definitely open up the problem here. And make it to where and as many people see it, it's unmanageable. How do you do that? How do you get ahead of that? Yeah. How do you get ahead of it? Well, you use your own technology to help, right? Yeah. As much as it creates that data sprawl, you can tell it to manage that data as well. You know, it's funny because when I talk to people, I always say that what was impossible yesterday is possible today. And, what is true today may be false tomorrow and what is false today will be true tomorrow. And the pace of innovation I've been, you know, my white beard belies how it gives away how long I've been in the industry. But if you had taken me, if you had transplanted me back to twenty years ago when I first got into, well back then it was called network security. Just sort of making the transition into information security. After I left academia, and went into this field, if you had told me that we would have the capabilities that we have today from an AI perspective, I honestly would have thought that you were, you were crazy. I didn't think that we would be at this point today. And then even five years ago, I gave a keynote talk at a major cybersecurity conference. It's not five years ago, eight years ago now. And, I gave a talk at this conference talking about applications of artificial intelligence and the sci fi level advances will continue at a pace that we haven't seen before. The applications for cyber security are very, very broad. Even then I was wrong, because I underestimated the cumulative pace of innovation. So, it hasn't been linear. There's been linear progress. And then there's been these big jumps. Right? Dictating our technical evolution every three months, right? AI is I taking or dying wasn't expecting it. I don't think anyone in the industry was. And now this has presented us with a massive productivity, on the regular business side. We have to harness that on our end as data security practitioners and cyber security practitioners. We have to use that same mechanism in our own tooling, in our own approach and no longer think of what was it was impossible to view all of the transactions and all of the interactions across all our data, across all these channels and perform this analysis. We have to change our view and go, maybe it is possible. We can use these tools to now go and do that. But we have to do that effectively. Exactly. I mean, and I think it goes back to where we understood for ourselves, you know, and that's kind of where it starts. When you're facing the impossible, and I think that's where we have, just as humanity, technology. We innovate to overcome the impossible. Don't get stopped, okay? We innovate, we drive through that. That's exactly what we're looking at here. When we're looking at the impossibility of now cybersecurity and the AI age, much less what's coming after quantum, you've got to look ahead. You can't look at the traditional paradigms that exist and think and rest on those laurels. It's not going to survive the evolution of technology. As you said, it's happening so quickly, you have to basically want to be using and that's kind of where we came to. You've got to use the same cutting edge technology to control the cutting edge technology in many ways. Okay? That's how you solve the impossible, make it possible. Exactly. That's how we make the impossible possible. Exactly. I love that line you used. I said, you said we innovate to overcome the impossible. I think that's very much what we've done here and how we've looked at the problem that's been presented to us. It's not only how do we secure our customers that's our focus, that's our mission as we started as a company and remains today but that grows and now we see that growing beyond it's not just about security, security has now grown into how do I be compliant with all of the laws, all of the regulations? Why are you securing that data? Because of the implications from a legality if you don't, right? It's basically expanding that security paradigm, but in the same light of what do I need to do to lawfully operate and to be compliant and to do right for my customers as well. Hence the privacy and data protection laws, you know? And of course, just understand our overall risk, right? The old way of going in and doing an assessment and coming back and saying, yeah, you know, our risk is about this. And then it's immediately out of date by the time you've read the report because it's based on data that was gathered six months ago. It has to be far more real time. This, on the people are creating that data, transforming that data in real time and it becomes something more or something less. It's dynamic. Exactly. So we've covered, you know, kind of the fundamental things that have to go into a program today. The understanding of what data governance is, how important it is to understand, what we've got, where it is, who's got access to it, what and importantly, what rules and regulations apply to that data. So now we've got an understanding of what we need to do. I think in our next chat, we're going to talk about how we actually go about doing this in the real world and actually applying some of this technology to achieve those outcomes. But I've really enjoyed our conversation today and, I think that, this is a problem that touches every organization. As I said in my opening remarks, whether big or small, all organizations are facing these challenges and the challenge of effectively understanding your data, governing it effectively, complying with the rules and regulations that apply to it, knowing which ones you need to comply with and then having meaningful risk reduction at the end of it. This is a challenge that every organisation faces. And what we are doing here is more relevant than ever before. Yeah, and as we mentioned earlier too, it's no longer just that singular discussion about securing the data with the CISO. The entire C suite needs to understand this. It's the implications to the operation of the company from a legal, can I continue to operate? Am I going to have a $5,800,000 fine because I didn't do what I needed to do in the operation Things of that nature, which basically hit the bottom line. They need to be considered and thus it needs to be a fulsome conversation across the top. And that kind of brings it down to, as well as how do you attack this, which we'll get into our next one, because basically you're hearing all of these pillars of data governance, but what tools? How do I keep all these tools aligned? How do I manage That's it what we'll dive into and I think get into more detail on our next session and share that. Great. Well, thank you very much for your time today, Michael. Thanks for everyone joining us. I look forward to seeing you shortly on our next installment and enjoy the rest of your day or evening or morning. We're across the globe. I appreciate the time and you taking the time and having the discussion. It's important.