Data Protection Trends in Children’s Online Gaming

When we think about children’s data protection, the first issues our minds usually jump to are topics like social media. And that would make sense – online social networks make up a great portion of kids’ internet usage and therefore pose a proportionally high risk.

But what is often overlooked is the fact that many children are also spending their time playing online video games. A recent report found that 76% of kids younger than 18 in the United States play video games regularly.

This is a problem because, like social media, online gaming platforms collect a large amount of data from their users. This includes personal information like names, addresses, and birthdays, as well as more sensitive data like GPS location and biometric data. And, due to the nature of gaming, this data is often collected without the user’s knowledge or consent.

This raises a number of concerns about children’s privacy and data security, as well as the potential for misuse of this information. In this article, we’ll explore some of the key issues related to children’s online gaming and data protection, as well as what measures can be taken to mitigate these risks.

The Safety and Data Risks Faced by Children in Online Gaming

Children and youth are uniquely vulnerable to the dangers posed by the internet. They are still in the process of developing both physically and mentally, which can make them more susceptible to harm. This is especially true in the case of video games, where a slew of potential risks exist.


Children’s data can be used to exploit their vulnerabilities and hook them into playing video games for long periods of time. This can lead to addiction, which in turn can have several negative consequences. These include social isolation, sleep deprivation, and even poor academic performance. In severe cases, it can lead to mental health problems.


One of the biggest dangers children face when gaming online is manipulation. Game developers and companies have a vested interest in keeping players engaged, and they often do this by using personal information to curate highly targeted in-game advertisements and content. This can be extremely persuasive, and children may be coerced into making social connections or purchases that they wouldn’t otherwise make.

Contact Risks

Another potential danger of online gaming is the possibility of contact risks. When players reveal their personal information, such as their email address or home address, they open themselves up to the possibility of being contacted by someone they don’t know. This can be especially dangerous for young children, who may not yet have the ability to distinguish between safe and unsafe people.

Gambling-Like Mechanisms

Many online games make use of gambling-like mechanisms, such as loot boxes, that can entice players to spend more money. These mechanisms are particularly risky for children, who may not have a full understanding of how they work or the potential financial consequences.

International Examples of Legislative Age Assurance Requirements

As experts have sounded the alarm over children’s data security in the scope of online play, governments have responded through the proposal and institution of several regulatory frameworks aimed at addressing the problem. A number of noteworthy pieces of legislation have come into force around the world over the past few years, and while each differs slightly in content, they all have one common goal: doubling down on companies’ responsibility to protect their youngest users.

Here are just a few examples of prominent regulatory frameworks to have been rolled out in major countries and regions:

U.K. Information Commissioner’s Office Age-Appropriate Design Code

The age-appropriate design code, informally known as the Children’s Code, was first implemented by the UK’s Secretary of State in September 2020 in an effort to codify the rules and enforcement procedures surrounding online services that process children’s data. It applies to any company that offers online services – such as social media platforms, apps, websites, or gaming services – that are likely to be accessed by children under the age of 18.

The AADC outlines standards on 15 different topics:

●          Best interests of the child

●          Data protection impact assessments (“DPIA”)

●          Age-appropriate application

●          Transparency

●          Detrimental use of data

●          Policies and community standards

●          Default settings

●          Data minimization

●          Data sharing

●          Geolocation

●          Parental controls

●          Profiling

●          Nudge techniques

●          Connected toys and devices

●          Online tools

Each of these covers a unique facet of online service design, but all work together to create a robust sense of protection for minors. Companies are expected to take a risk-based approach to their compliance for each, meaning that the solutions they implement should be appropriate for the risks posed by their products.

While failure to comply with the Age-Appropriate Design Code itself does not make a person or business liable to legal proceedings, it does open their risk to being prosecuted for violation of the UK GDPR and/or PECR.

OECD Recommendation on Children in the Digital Environment

Adopted in 2021, the OECD Recommendation on Children in the Digital Environment is a formal set of guidelines aimed at promoting children’s data safety online. It sits in tandem with the OECD’s Digital Service Provider Guidelines to outline the organization’s position on data governance for digital economy actors.

The Recommendation is unique in that it is non-binding, meaning that countries are not held to its standards in a legal sense. However, it does provide a sort of international benchmark for how different nations might approach regulation in this area.

The main tenet of the OECD’s recommendation is to create online environments in which online providers take the “steps necessary to prevent children from accessing services and content that should not be accessible to them, and that could be detrimental to their health and well-being or undermine any of their rights.” 

EU Digital Services Act

The EU Digital Services Act is a newer piece of legislation that was just agreed to by EU members in April 2022. It’s set to be the Union’s main ‘rulebook’ when it comes to protecting citizens’ online privacy both now and in the future as big tech continues to redefine the way we interact with the internet.

Under the DSA, online service providers will be held to higher standards when it comes to the way they process the personal information of both child and adult EU citizens. The Act includes several provisions specifically aimed at protecting minors, including a ban on advertising aimed at children and the algorithmic promotion of content that could potentially cause them harm such as violence or self-harm.

Once formally adopted by EU co-legislators, the Digital Services Act will apply after 15 months, or January 1, 2024, whichever is later. It’s being lauded as a major first step in the effort to protect children’s (and all users’) privacy online and has set the standard for future frameworks of its kind.

UK Online Safety Bill

While still before the UK’s House of Commons, the Online Safety Bill is another potential change to come in the data privacy landscape. It addresses the rights of both adults and children when it comes to their data online, with a special focus on the latter.

If passed, the bill would impose a safety duty upon organizations that process minors’ data to implement proportionate measures to mitigate risks to their online safety. While the legislation has had a few bumps in the road since its original proposal, new UK Prime Minister Liz Truss says she plans to adapt and move forward with it in the coming months.

California Age-Appropriate Design Code Act

California is no stranger to data privacy laws. Honing one of the most comprehensive sets of state regulations in North America, the CCPA, its priorities are clearly set on protecting citizens’ rights and personal information online. In our “California Consumer Protection Act (CCPA) Fines” blog post we discuss which companies the act would apply to, the basics of the CCPA, the penalties for violating the law, and the proposed changes that could affect the law in the future.

The state’s government has just taken another step in that direction with the Age-Appropriate Design Code Act, which unanimously passed a Senate vote on August 29th of this year.

If enacted by Governor Newsom, it will require businesses to take extra measures to ensure their online platforms are safe for young users. This entails regulating things like the use of algorithms and targeted ads, as well as considering how product design may pose risks to minors.

An August 2022 article on the legislation in The New York Times stipulated that when signed, the CAADCA “could herald a shift in the way lawmakers regulate the tech industry” on a broad level in the United States. It pointed to the fact that both regional and national laws in the country have a proven ability to affect the way tech companies operate across the board, and a change in California could very well mean a change for the rest of the US.

Emergent Solutions

Recent regulatory frameworks in data privacy have marked a massive shift in the way companies are required to handle and protect the personal information of their users, with a specific focus on children. In response, many online platforms and service providers have made changes to their terms of service and product design in order to adhere to these new standards.

Some of the biggest emerging solutions include:

Privacy by Design

Privacy by design is an engineering methodology that refers to the incorporation of data privacy into the design of products, services, and systems. The goal is to ensure that privacy is considered from the very beginning of the development process, rather than being an afterthought.

There are seven principles of privacy by design:

1.         Action that is proactive not reactive, preventive not remedial

2.         Privacy as a default setting and assumption

3.         Privacy embedded into design

4.         Full functionality – positive-sum, not zero-sum

5.         End-to-end security and full lifecycle protection

6.         Visibility and transparency

7.         Respect for user privacy

The privacy by design methodology was first introduced in the 90s by Ontario Privacy Commissioner Ann Cavoukian. It’s considered one of the most important data privacy frameworks in the world, and its principles are being promoted as a basis upon which online video games and other digital platforms can better protect children’s privacy.

Risk-Based Treatment

As has been seen in recent years, data protection legislation is moving away from a one-size-fits-all approach and towards a more risk-based treatment of personal information. This refers to the idea that data controllers should consider the risks posed by their processing activities when determining what measures to put in place to protect the rights and freedoms of data subjects. For children, this means taking into account the fact that they are a vulnerable population and tailoring data protection measures accordingly.

Responsible Governance

Responsible governance refers to the ethical and transparent management of data by organizations.  It’s based on the principle that data should only be collected, used, and shared in a way that is transparent to the individual and serves their best interests.

There are four main pillars of responsible governance:

Transparency: individuals should be aware of how their data is being used and why

Choice: individuals should have the ability to choose whether or not to share their data

Responsibility: organizations should be held accountable for their use of data

Security: data should be protected against unauthorized access, use, or disclosure

The concept of responsible governance is gaining traction as a way to protect children’s privacy online. It’s being promoted as a means of ensuring that data collected from children is only used in ways that are beneficial to them, and not for commercial or other ulterior purposes.

Parental Controls

In the face of ever-growing concerns about children’s privacy online, many parents are taking matters into their own hands by implementing parental controls on their devices and home internet networks. There are several different ways to go about this, but some of the most popular methods include setting up child-friendly browsers and content filters, as well as using apps that track screen time and limit app usage. While parental controls are not a perfect solution, they can be a helpful way to give parents some peace of mind when it comes to their kids’ online activity.

Video games can help children develop their creativity, social skills, and knowledge. However, as digital technologies become more sophisticated and firmly entrenched in our daily lives, it is increasingly important that we begin to structure them in a way that considers and respects children’s privacy rights. By understanding the trends in data protection, and by implementing responsible governance practices, we can help create a safer and more secure online environment for children to play and learn in.

California Consumer Protection Act (CCPA) Fines

Any company, organization, or marketer that does business online knows (or should know) about the California Consumer Protection Act (CCPA). But with all the talk about the law, it can be hard to understand what it actually is and how it affects businesses. In this article, we’ll take a look at the basics of the CCPA, the penalties for violating the law, and the proposed changes that could affect the law in the future.

What Is the California Consumer Protection Act?

The California Consumer Protection Act (CCPA) is a set of regulatory guidelines imposed upon businesses that collect consumers’ personal data established by the California State Government. It is among the strongest and most stringent privacy laws in the United States and has a far-reaching impact in terms of both the businesses to which it applies and the rights it affords consumers.

The CCPA was passed in response to the numerous high-profile data breaches that have occurred in recent years, as well as the growing concern over the use of personal data by businesses for marketing and other purposes. The law is designed to give consumers more control over their personal data, and to hold businesses accountable for the way they collect, use, and protect that data.

The Provisions of The California Consumer Protection Act

The California Consumer Protection Act covers four principal provisions: the right to know, the right to opt-out, the right to delete, and the right to equal service. We’ll briefly explain each below.

1. The Right to Know

Under the CCPA, consumers have the right to know the personal information businesses collect and how they use it. They’re entitled to the direct disclosure of what categories of data this information falls under and are also given the ability to request further, more specific details about its use as needed. This includes inquiries about what personal information a business has sold, what types of third parties it has sold the information to, and where it got that data in the first place.

(Cal. Civ. Code § 1798.100, § 1798.110, § 1798.115)

2. The Right to Opt-Out

The California Consumer Protection Act mandates that businesses must provide individuals with an easy and direct way to opt-out of the sale of their personal information. The most common way this is done is through a “Do Not Sell My Personal Information” link on a website homepage or cookie preference banner with a similar toggle.

It’s also worth noting that businesses must automatically opt-out of the sale of an individual’s data if they have direct reason to believe that the person is under 16 years old. In these cases, it is only their parent’s, guardian’s, or own decision (if between 13 and 16) to consent to anything otherwise.

(Cal. Civ. Code § 1798.120)

3. The Right to Delete

Individuals protected by the California Consumer Protection Act have the right to request the deletion of their personal information from the entities who collect it. Businesses that receive these requests are obliged to fulfill them upon receipt unless the information they have collected is necessary for things like the completion of a related transaction or contract.

(Cal. Civ. Code § 1798.105)

4. The Right to Receive Equal Service

The CCPA is very clear about discrimination and its intolerance for businesses that use it against consumers who exercise their rights. The law directly prohibits businesses and entities from treating individuals unfairly because they’ve requested to know what personal information is being collected about them, or because they’ve opted out of the sale of their information. This also includes refusing service, providing a lower quality of service, or charging different prices or rates for services.

(Cal. Civ. Code § 1798.125)

Defining ‘Personal Information’

The CCPA’s definition of what qualifies as ‘personal information’ is important to fully understand the scope of the law and how it applies.

As directly written, it considers ‘personal information’ to be any “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” (Cal. Civ. Code § 1798.140(o)(1)).

Examples of what type of data this can cover include:

●         Social Security Numbers

●         Purchase histories

●         Drivers’ license numbers

●         Internet Protocol addresses

The information listed above falls into the personally identifiable information (PII) category. To learn more about PII and how legislation is trying to protect it, view our previous posts: “PIPL: What You Need to Know About Changing Cybersecurity in China”, and “A Guide to the GDPR, Europe’s Stringent Data Protection Law”. Protecting PII is our focus here at TeraDact.

It’s worth noting that while technically meeting the definition, some types of information are not considered to meet the threshold of ‘personal’ and are not subject to CCPA rules. Publicly available information, for example – like someone’s name printed in a newspaper – is not included. Nor is de-identified or aggregate data, which are both defined and further explained in the CCPA itself.

Who Does the California Consumer Protection Act Apply To?

So, who’s subject to all of these rules and provisions? The CCPA was specifically designed to target businesses but can still apply to any organization or person that operates in California and meets at least one of the following criteria.

Annual Revenues Of $25 Million Or Higher

This part is pretty self-explanatory. Businesses making more than $25 million in annual revenue are generally required to comply with the law.

Commercially Buying, Sharing, Receiving, Or Selling the Data of Over 50,000 Consumers Annually

Another clear-cut rule. If your business handles the personal information of more than 50,000 Californian consumers, residents, or households on an annual basis, you’ll have to comply with the law.

It’s important to note that this rule applies even if you don’t share or sell the information you collect – simply having it in your possession puts you over the threshold.

Deriving Over 50 Percent of Annual Revenues from The Sale of Personal Information

This is another fairly straightforward rule, but one that’s worth unpacking a bit. The ‘sale’ of personal information under the CCPA can be broadly defined as anything that would enable access to the data – including exchanging, renting, releasing, disclosing, or otherwise making it available.

So, if more than 50 percent of your business’s annual revenue comes from activities like this, you’ll be required to comply with the law.

What Are the Penalties for Non-Compliance with The California Consumer Protection Act?

Violations of the California Consumer Protection act don’t go unpunished; the law outlines several penalties for non-compliance with its regulations. And because it applies to businesses, service providers, and individuals, there’s a range of potential punishments that could be levied.

Civil Penalties

The most common penalties for violating the CCPA are civil penalties. Civil penalties are a type of financial remedy government entities impose for wrongdoing. In the case of the CCPA, civil penalties are assessed and enforced by the state attorney general’s office, which has the authority to investigate potential violations and file lawsuits on behalf of Californian consumers.

The California Attorney-General can pursue penalties from organizations that violate any part of the California Consumer Protection Act.

Just some examples of what these violations can look like include:

●         Failing to respond to consumers’ requests for the deletion of their personal information

●         Failing to have or uphold CCPA-compliant privacy policies

●         Selling consumers’ personal data without offering them a means to opt-out

●         Discriminating against individuals who exercise their rights under the CCPA

●         Failing to give adequate notice of the collection of personal information

Service providers who retain, use, or disclose personal data for purposes outside of their contracts with businesses may also be liable for penalty under the CCPA.

People can dispose themselves to penalty as well, by unlawfully breaching rules on the onward transfer of personal data.

The costs of violating the CCPA are severe, with maximum fines of up to $2,500 per violation or $7,500 per intentional violation. And because the law applies to each consumer whose data is mishandled, a single incident could result in multiple penalties.

Waiting Period

It’s important to note that businesses that violate the California Consumer Protection Act have a waiting period before they can be fined. The law stipulates that businesses have 30 days’ notice to correct any violations before they can be subject to penalties.

If the business can cure the noticed violation(s) and provide an express written statement indicating so and that no further violations shall occur, then no action may be brought.

Enforcement by The California Attorney-General

The CCPA gives the state attorney general’s office broad enforcement powers, including the authority to investigate potential violations and file lawsuits on behalf of Californian consumers.

In addition to seeking civil penalties, the attorney general can also seek injunctions or temporary restraining orders to stop businesses from violating the law.

Private Right of Action

In addition to the civil penalty route, the CCPA also gives consumers the right to take legal action on their own behalf in the case of a violation. Private action is a term that refers to the ability of an individual to bring a lawsuit against another party without the involvement of the government.

The CCPA gives Californian consumers the right to sue businesses, service providers, or any person acting on behalf of a business or service provider for data breaches that result from the unauthorized access, theft, or disclosure of their personal information.

Consumers can sue for damages even if they haven’t suffered any financial loss because of the breach, and they can also seek punitive damages if the court finds that the business or service provider acted recklessly or intentionally violated the law.

The financial repercussions of these cases are somewhat less severe, with a range of $100 to $750 that can be sought per consumer per incident. Actual damages may also be awarded, but only if the consumer can prove that they’ve suffered a financial loss because of the breach.

(Cal. Civ. Code § 1798.150)

Unlike civil penalties, private action lawsuits do not require consumers to provide notice to businesses of their intention to sue.

Proposed Amendments to the CCPA

Like any major piece of legislation, the California Consumer Protection Act is poised to change with time. This is especially true given the law’s subject matter; because technology is always changing, the ways in which personal data is collected and used will likely continue to evolve.

Considering this, lawmakers have already proposed several amendments to the CCPA. These amendments range from technical corrections to substantive changes that would modify the scope or enforcement of the law.

Some potential prominent amendments to come include:

A Shift Away from Dark Patterns

Dark Patterns are a type of user interface design meant to trick people into doing things they might not want to do, such as signing up for a service they don’t need or providing personal information they might not want to share.

One recently proposed amendment to the CCPA would make it illegal for businesses to use dark patterns when collecting personal information from consumers. This would help to ensure that consumers are only providing their personal data willingly and with full knowledge of how it will be used.

The Right to Correct Personal Information

Newly proposed amendments suggest adding a ‘right to correct’ inaccurate personal information to the CCPA. This new section would give consumers the right to correct any inaccurate personal data businesses collect, as well as outline documentation requirements, methods for correction, disclosure requirements for denial, and alternative solutions.

While relatively new to the CCPA, this concept has been around for some time on an international level and is already familiar to many businesses that are subject to the GDPR. For local, California businesses though, this proposed amendment would simply be another obligation to add to their CCPA compliance checklist.

Privacy Policy Requirements

In addition to the information already required to be disclosed in a privacy policy under the CCPA, proposed amendments would add several new specific elements that businesses would need to include.

These are:

●         The date the privacy policy was last updated

●         The length of time the business plans to retain each category of personal information, or if that’s not possible the criteria it uses to determine how long it will be retained

●         Disclosure of whether the business allows third parties to control their collection of personal data, and if so, the names and business practices of these parties

●         A description of consumers’ new rights as described in the amendment

●         Clear directions for how consumers can exercise their newly amended rights

●         A description of how the business will process opt-out requests

Organizations that process the personal data of 10 million consumers or more will also be required to include a link to certain reporting requirements in their privacy policy under this new amendment.

The CCPA’s reach and impression on business is significant, there’s no doubt about that. The law gives Californian consumers a number of rights with respect to their personal data, and businesses that mishandle that data can be subject to some severe penalties. By educating yourself on the law and taking steps to ensure that your business complies, you can help avoid any potential problems down the road.

Why Your Organization Needs to Consider Hyperautomation

Your organization needs to consider hyperautomation as the next step in its evolution and growth. Today’s fast-paced world requires organizations to have an unprecedented level of flexibility and agility in order to get and stay ahead. They need systems that invigorate the work they do, simplify processes, and evolve them in favor of better productivity and higher efficiency.

This is where hyperautomation comes in.

What Is Hyperautomation?

Hyperautomation is a strategic use of automation technology to optimize every process possible within an organization. Its ultimate goal is to enable repetitive processes to occur without the need for manual assistance—a process that runs itself flawlessly.

Supported by tools like Machine Learning, Robotic Process Automation, and Artificial Intelligence, hyperautomation seeks to transform both modern and legacy processes and equipment into systems that are more autonomous and efficient.

Hyperautomation employs a multitude of tools and technologies, including:

  • Artificial intelligence (AI)
  • Machine learning
  • Robotic process automation (RPA)
  • Event-driven software architecture
  • Integration platform as a service (iPaaS)
  • Low-code/no-code tools
  • Packaged software
  • Business process management (BPM) and intelligent business process management suites (iBPMS)
  • Other decision, process, and task automation tools

Who Uses Hyperautomation?

Hyperautomation is growing across the board but is most commonly sought out by organizations that require an advantage in highly distributed, fast-paced, demanding environments. This is especially true for those who have remote workforces, and/or small on-site staff rosters but still require quick execution of complex processes.

Some common needs that incline organizations to use hyperautomation include:

  • A need to keep pace with demand
  • Outdated and inefficient work processes that result in competitive latency
  • An inability for corporate IT to keep pace with organizational needs due to a lack of knowledge and resources
  • Employee ambition and curiosity
  • A need to meet and maintain regulatory compliance
  • A desire for improved consistency in production and better quality output products with reduced or no human error

A benefit of hyperautomation technology is that while it’s favored by certain industries, any organization can benefit from it. This is true regardless of whether their existing equipment is old or new, or if their processes are already automated.

The Benefits of Hyperautomation

1 – It optimizes and amplifies workflow.

Hyperautomation allows organizations to optimize and streamline repetitive and tedious tasks. This supports businesses in eliminating unnecessary work for staff and improving overall operational efficiency, thereby reducing costs.

It similarly positions businesses to further evolve their existing capacities, by providing them with the means necessary to combine tools, technologies and components to make their work more even autonomous. All of these improvements in tandem allow for more productive and ultimately fruitful operations, which makes the lives of workers easier and outlooks of businesses brighter.

2 – It increases agility.

Agility has become a buzzword for organizations who want to outperform their competitors. Defined by a business’ capacity to respond and adapt to changes in the demands of their environment, agility supports organizations in effectively managing and scaling their operations long term. It’s especially important in turbulent business sectors, where an organization’s needs and priorities are forced to constantly shift.

Intelligent automation tools have long proven to be a boon when it comes to addressing the notion of agility in operations management, as it supports businesses in remaining dynamic in unpredictable conditions.

3 – It boosts staff wellbeing and positivity.

Staff happiness is key to good output. And unfortunately, staff happiness can be precarious: Inefficient systems, too-large workloads, and other common pitfalls lead to staff dissatisfaction and low output. Hyperautomation solves this problem by employing technology to remove some of the most arduous jobs  from the hands of human employees. This leaves workers with more time to focus on tasks that are more mentally stimulating and of value, which in turn supports a positive work environment and output.

4 – It eliminates human error.

Humans are prone to mistakes, which is really just an innate part of our existence that can’t be changed. But that humanity can throw a real wrench in highly-repetitive large scale operations that rely on consistency and speed. By its very nature, automation is designed to remove the potential for error that is commonly introduced when relying on human staff for completing tasks.

It allows organizations to restructure the way they delegate their binary and repetitive work in favor of options that are designed to do such tasks with perfection. This has the capacity to bolster operations by reducing the amount of errors being introduced into workflows, as well as improving the ultimate quality of products being processed.

5 – It enhances ROI.

It goes without saying that increased efficiency means better results. By stimulating workflows, improving output, and economizing the use of resources, efficiency has the power to boost a company’s ROI in more ways than one. This is one of the most notable benefits of hyperautomation, given its massive potential to optimize business operations and simplify tasks.

With the help of intelligent automation tools, businesses can operate with more streamlined and effective processes, which in turn allows for a more productive use of resources—including staff time, finances and physical infrastructure. This delivers an enhanced ROI for organizations, which equates to better long-term outlook and prosperity.

6 – It fosters collaboration and engagement.

A wrokforce’s ability to connect with itself is essential to its efficiency and productivity as a whole. This can sometimes be a challenge in business, especially for organizations that run complicated and diverse workflows.

Hyperautomation enables businesses to provide their teams with the means to connect with one another through the tools they use on a daily basis. The cross-departmental nature of an organization’s switch to digital transformation encourages every corner of the business to come together and engage in the process. With hyper automation software, RPA ,and other intelligent tools, employees can be better positioned to get involved in their teams and collaborate with one another.

Overcoming the Challenges of Implementing Hyperautomation in Your Organization

Prior to embarking on a mass implementation of hyperautomation, businesses should be sure to also consider the potential barriers they may face as well as identify how they can overcome them. Some of the most common include: Not having a codified way to measure success, choosing the wrong automation solution, lacking an automation-informed workforce, and, of course, the cost of going “hyper.”

However, each of these challenges can be met head-on and navigated in order to reach full hyperautomation, if that’s an organization’s goal. Set KPIs and benchmarks to track progress over time as you implement hyperautomation; work with a consultant or hyperautomation expert to determine what system works best for your organization’s needs, and utilize their support as you make the transition; invest in training programs for your current employees, so they’re on board and ready when the transition happens. And, finally, when it comes to cost, look at it as an investment. If you can put in the capital to make the transition, it’ll pay itself back in no time. And if it’s not something your company is ready to front at the moment, consider cost-sharing options like open source automation or partnerships with other organizations.


Hyperautomation can be a game changer for businesses when implemented correctly. By understanding the challenges faced by businesses when implementing automation and taking steps to overcome them, companies can maximize the benefits of hyper automation and see a significant increase in ROI. Are you ready to invest?

Overcoming the Top Challenges of Zero Trust Implementation

Zero Trust means what it says: No trust, for anyone, no matter what.

The increasingly popular approach to security requires all users—regardless of whether they’re inside or outside of an organization’s network—to be authorized, authenticated, and continuously validated for security configuration. It controls who can access which resources and implements a host of checkpoints before granting or keeping a user’s access to applications and data. Because Zero Trust is a naturally extensive and complicated system, it can be a very difficult one to implement.

With that in mind, we’ve compiled some of the greatest challenges organizations face in instituting this technology, as well as some tips on how to mitigate them.

1 – Ongoing Management

Some security frameworks and solutions can be configured, deployed, and then left without the need for much management or oversight afterwards. Unfortunately, this isn’t the case when it comes to zero trust.

The whole point of zero trust is that it never “trusts,” so it is reliant upon ongoing authentication and gatekeeping. In this regard, many businesses struggle with not being able to “set it and forget it,” as we like to say.

Leaders know organizations are constantly evolving, from new hires to shifting infrastructure; and with changes come increased security needs. And unfortunately, with zero trust technology, these needs require constant attention.

A good practice in implementing the zero trust approach is to leverage tools and automation where possible. Such technologies can be helpful in regularly checking for firmware updates, issuing alerts, and simplifying the process of managing security altogether—even when your security framework demands time and attention.

2 – The Need for Secure Hardware

Many purpose-built systems come with some form of built-in security safeguard. However, part of implementing a zero trust framework is securing not just software, but hardware too. This is a challenge for many organizations, as it can be difficult to know where to start.

One way organizations go about this is by taking an inventory of all the devices that connect to their network. This includes not only laptops and desktops, but also printers, sound systems, and even security cameras. Once they have a list of everything that needs to be accounted for, they can start to research and deploy security measures for each one. In some cases, organizations may need to implement new hardware system altogether.

This can be a daunting task, but luckily there are a number of resources available to help make it easier. The National Institute of Standards and Technology (NIST) has published several guides on securing different types of devices, which can be a helpful starting point.

In addition, many manufacturers offer guidance on how to best secure their products.

3 – Zero Trust Necessitates Flexible Software

Another common challenge that many organizations face with zero trust technology is finding that their current software does not work well with the new framework. This lack of integration and coordination can lead to confusion, errors, and ultimately security breaches.

To properly secure data and devices across a network, businesses need a solution that is built for zero trust from the ground up, which can be challenging to find.

Fortunately, there is a growing number of vendors that offer solutions for organizations in this position. Whether your organization can simply make adjustments in order to align software and hardware security, or has to do a more complete overhaul, there are resources out there to guide and support you along the way to zero trust implementation.

4 – Impact on Staff Productivity and Performance

When transitioning to a zero trust security model, it’s important to keep in mind that this new way of doing things may have an impact on staff productivity.

The increased security measures required for zero trust often mean additional steps, friction points, and barriers to accessing the applications and data employees need to do their jobs. This can lead to a decrease in efficiency as workers spend more time trying to gain access and less time getting their work done.

While frustrating for employees and employers alike, this is an opportunity to leverage user training and education to improve efficiency and comfort working in a zero trust framework.

Providing users with clear and concise instructions on how to access the resources they need can go a long way in mitigating any decrease in productivity. In addition, taking the time to explain the importance of these new security measures and how they will benefit the company as a whole can help employees understand why these changes are being made and help encourage them to lean in, even when it’s more difficult.

5 – Taking Things One Step at a Time

The best method to reduce the inherent risks associated with its implementation is to avoid thinking of zero trust as a binary, all-or-nothing transition. You can begin to build a zero-trust architecture without scrapping existing systems altogether.

This starts by determining the most critical processes and data to be secured within the organization. Multi-factor authentication, special access, and session management can then be applied to these sensitive operations and data, upping security by leaps and bounds while still utilizing the systems currently in place. The remaining data is subject to standard perimeter controls, while only the most essential information is subjected to a zero-trust model.

It’s often best to gradually introduce zero-trust security in this way in order not to jeopardize the continuity of existing cybersecurity strategy. By doing so, companies can effectively secure important assets—and because they’re not entirely shifting from one system to another, expose themselves to less risk in the process.

Zero trust is quickly becoming the standard for data protection, but the shift doesn’t come without challenges to organizations and their employees.

It’s important to remember that zero trust security requires both hardware and software solutions tailored specifically to a zero trust framework, and this can pose challenges to staff and infrastructure. With the right planning and preparation, however, zero trust security can be an incredibly valuable tool in protecting an organization’s data.

Products like Teradact’s Tokenizor+ and Redactor+ are powerful tools to simplify and strengthen organizations’ security measures as they begin to implement—or bolster existing—zero trust frameworks.

A Guide to the GDPR, Europe’s Stringent Data Protection Law

The General Data Protection Regulation is the toughest and most stringent privacy legislation on the planet. Created and enacted by the European Union (EU), the GDPR imposes obligations on any business worldwide that targets or collects data relating to people in the EU (in similar fashion to the recent Chinese PIPL legislation).

The Basics

The legislation, which went into effect in May of 2018, applies to any company operating in the EU, as well as those outside of the EU that provide goods or services to clients or businesses in the EU. It levies harsh fines against violators, with penalties reaching into the tens of millions of euros.

The GDPR is particularly daunting as far as international cybersecurity law goes, because its regulations are large and far-reaching in scope, yet not very specifically defined. Compliance proves especially tricky for small and medium-sized enterprises.

The 1950 European Convention on Human Rights guaranteed the right to privacy to all Europeans, and it’s paved the way for continuous evolutions in privacy laws since it was created. The GDPR is the most recent evolution in European cybersecurity legislation, following explosive developments in the technology sector and an exponential increase in personal internet use (like the advent of online banking, Facebook, and widespread email accounts).

The GDPR defines a variety of legal terms specifically, including:

  • Personal data: Any information that relates to an individual who can be directly or indirectly identified
  • Data processing: Any action performed on data, whether automated or manual
  • Data subject: The person whose data is processed (customers or site visitors)
  • Data controller: The person who decides why and how personal data will be processed
  • Data processor: A third party that processes personal data on behalf of a data controller. There are special rules for these individuals and organizations.

Under the GDPR, data controllers must take a risk-based approach to data security. They must identify and assess the risks to the personal data they collect and process, and they must implement appropriate technical and organizational measures to mitigate those risks.

Core Concepts

The GDPR establishes several core concepts, each with its own definition. The following are some key principles as they’re outlined in the legislation:


Data controllers must be able to demonstrate their compliance with the GDPR. There are a variety of methods to accomplish this, including:

  • Designating data security responsibilities to your team.
  • Keeping good records of all data you collect, how it’s used, where it’s kept, who’s in charge of it, and so on.
  • Training your employees and putting in place technological and organizational security measures.
  • Having data processing agreements in place with third parties who you contract to handle data for you.
  • Appointing a designated Data Protection Officer (DPO).

Data Security

Businesses are required to secure data by using adequate technical and organizational precautions. Technical measures can include anything from requiring your workers to use two-factor authentication on accounts where personal data are stored to contracting with cloud providers that employ end-to-end encryption as a security measure.

Organizational precautions entail things like employee training seminars, creating a data privacy policy in an employee handbook, or restricting access to personal information to only those workers in your organization who require it.

You have 72 hours to notify data subjects after a data breach, or you may be fined. This notification requirement may be waived if you employ technological safeguards, such as encryption or tokenization, to render stolen data useless.

Protection By Design and By Default

Under the GDPR, everything you do in your company must, “by design and by default,” consider data security. Essentially, this means that any new product or service must be designed in accordance with its standards.

Launching a new app? Make sure to plan ahead and ensure built-in protections for any personal data the app might possibly collect from users; do your best to minimize data collection in the first place, then secure what you do collect with the tightest measures possible.

When You’re Allowed to Process Data

There are only certain circumstances in which it’s legal to process personal data in the first place. Don’t do it unless you can justify it with one of the following criteria:

  • You obtained explicit, clear consent from the data subject to process their data. (e.g. They’ve opted into your marketing email list.)
  • Processing is required to execute or prepare for a contract in which the data subject is a party. (For example, before hiring someone, you’ll need to do a background check.)
  • You must process the data to comply with a legal obligation. (e.g. You receive an order from the court in your jurisdiction.)
  • You must process the data in order to save someone’s life.
  • You must process the data to carry out a public service or execute an official responsibility.
  • You have a good cause to use other people’s personal information. This is the most adaptable lawful basis, but the data subject’s fundamental rights and freedoms will always take precedence over this.

Once you’ve determined the legal basis for your data processing, you must record and notify the data subject. Transparency is key. If you want to change your justification, you must have a solid basis for doing so, document it, and notify the data subject.


The GDPR overhauled prior rules about what constitutes consent from a data subject to process their info. Consent under the GDPR must meet the following guidelines:

  • “Freely given,” “specific,” “informed,” and “unambiguous” are the key terms used for defining consent.
  • Consent must be “clearly distinguishable from the other matters” and communicated in “clear and plain language.”
  • Subject access rights are revocable at any time, and you must comply with their wishes.
  • Only with the knowledge and permission of their parent may children under the age of 13 give consent.
  • Documentary proof of consent must be obtained.

Data Protection Officers

Despite popular opinion, not every data controller or processor needs to appoint a Data Processing Officer. You are, however, required to employ a DPO if any of the following three circumstances apply:

  • You are a public entity other than a court performing judicial functions.
  • You must track people on a large scale and systematically and frequently as part of your core operations.
  • Your core activities include big-scale processing of data falling within Article 9 of the GDPR’s special categories, or data concerning criminal convictions and offenses, as specified in Article 10.

Even if you are not required to do so, you may choose to designate a DPO for a number of reasons. A competent DPO will have comprehensive understanding of the GDPR (and other similar legislation) and how it applies to the company, advising personnel regarding their obligations, offering data protection training sessions, conducting audits and monitoring GDPR compliance, and serving as a liaison with regulators.

For companies large enough and with enough resources to hire one, a DPO is a smart move as cybersecurity legislation is only getting more and more stringent.

People’s Privacy Rights

And, as all good data protection legislation should, GDPR promises individuals (aka “data subjects”) greater control over the data they share with businesses.

The following is a summary of data subjects’ privacy rights:

  • The right to be informed
  • The right of access
  • The right to rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object
  • Rights in relation to automated decision making and profiling


As noted in the beginning of this article, the GDPR is mainly enforced through the imposition of fines, edging into the hundreds of millions of euros.

Similarly, organizations found to be in violation of the new regulations are often subject to the resulting reputational damage.

The GDPR has certainly introduced its fair share—possibly more—of hurdles for businesses to overcome, but it almost surely won’t be the last of its caliber. Cybersecurity legislation is the new norm, and as our lives become increasingly intertwined with and reliant on technology and online data communication, legislation to protect individuals’ identity and security will only evolve to be tighter and more effective.

And, as we say in the US, “Ignorance is no defense.” So, it’s best to become familiar with the regulations now. The sooner you do, the less likely you are to face penalties down the road.

PIPL: What You Need to Know About Changing Cybersecurity in China

It’s no secret that cybersecurity issues in China have been a hot topic of debate lately. Chinese data security is particularly relevant for businesses with commercial connections in the country.

While many countries have tightened their privacy laws in recent years—like the European Union’s General Data Protection Regulation (or GDPR)—it’s been widely accepted that China is falling behind in their data protection efforts.

That changed on November 1, 2021: China established the Personal Information Protection Law (PIPL). China’s very first comprehensive data protection law, the PIPL was a critical evolution of Chinese data protection efforts, recognized internationally as a positive step in our increasingly connected cyber world. And yet, it poses new challenges to companies processing data in China or related to residents of the country.

So, what exactly does PIPL do?

Like most cybersecurity legislation, the primary purpose of the PIPL is to safeguard personal information rights and interests, regulate the processing of personal information, and encourage appropriate use of personal information (read: collect and securely store personal information when necessary, and use it only for the purpose for which it was collected). The PIPL adds to China’s previously lacking cybersecurity and data security legislation, bolstering the country’s regulatory approach to cyberspace alongside Canada, the US, Europe, and the like.

The PIPL contains several key provisions that are set to impact businesses operating in China. For one, it requires that firms only collect personal information that is lawfully obtained, truthful and accurate. The PIPL also regulates how personal information should be processed, including requirements for technical measures to protect personal information against cyber threats. (Luckily, we specialize in delivering technical measures to protect that sensitive information.)

Under the PIPL, “personal information” is defined as any data relating to specific or identifiable natural persons recorded by electronic or other means, except for data that has been anonymized. In other words, it’s the center of what we do here at TeraDact: Personally Identifiable Information, or “PII.” The new Chinese law also regulates and protects the “processing” of that personal information, which includes the gathering, storage, usage, altering, transmission, provision, public disclosure, and removal of personal data.

Let’s get into the nitty-gritty. (We won’t blame you if you want to scroll on past this part.)

Here we go.

The PIPL is made up of eight main chapters. They include:

  • General Provisions
  • Personal Information Processing Rules
  • Rules for Cross-Border Provision of Personal Information
  • Individuals’ Rights in Personal Information Processing Activities
  • Obligations of Personal Information Processors
  • Departments Performing Personal Information Protection Functions
  • Legal Liabilities
  • Miscellaneous Provisions

The following is a general overview of some of the key provisions outlined within these eight chapters.

  • Data Minimization Principle: The PIPL’s main tenet is that personal information should be collected, processed, and retained to the bare minimum extent necessary for each project in question.
  • Legal Basis for Processing: The PIPL mandates a legal basis for the processing of personal data, with the most important being individual consent. This is similar to the GDPR in its approach. Several exemptions are permitted, including those related to the performance of a contract in which the individual is a participant or when processing is required as part of the management of public health emergencies.
  • Extra-Territorial Scope: The PIPL is comparable to the GDPR in that it establishes a broad territorial scope, covering both the processing of personal information within China and actions undertaken outside of China where the personal data of an individual residing in China is utilized for (i) providing goods or services to individuals in China, or (ii) analyzing and evaluating the behavior of people within the country. In the case of qualification, there is an additional requirement that the foreign processor nominate a local representative to handle compliance.
  • Cross-Border Transfer: In the case of a personal information processor wanting to send such data outside of China, it must do so under contract with the Chinese government, pass a security inspection by the Chinese cyberspace administration, or obtain accreditation for data handling from a state-approved body. This obligation creates a significant compliance challenge for firms operating in China.
  • Separate Consent: The PIPL also addresses several situations in which data subjects’ separate or written consent will be required, including cross-border transfers, the sharing of personal information with third parties, and the processing of sensitive personal information such as medical records and financial records.
  • Data residency: The PIPL goes a step beyond the GDPR and CCPA in that it adds an explicit additional obligation for Critical Information Infrastructure Operators (CIIO), and other organizations that process personal data at a predetermined volume threshold, to store such data within China’s borders. While the exact definition of a CIIO is not specifically defined in the PIPL, the Regulations on the Security Protection of Critical Information Infrastructure of China’s cybersecurity law state that Chinese government authorities are responsible for identifying CIIOs.
  • Presumption of Liability: The PIPL implies that if the processing of personal information infringes on those rights and interests, and causes harm, the processor has the burden to prove it is not at fault.

Enforcement and Application of the PIPL

The PIPL will be enforced by the CAC, or the Cyberspace Administration of China (CAC).

Overall, the PIPL appears to be a valuable addition to China’s data privacy regulation, and with its imposition businesses will be more inclined to comply in order to avoid hefty fines for processors who break the law, including fines up to 5% of their yearly turnover. Other notable forms of penalization include the revocation of business permits/licenses and individual liability for business executives.

Unlike the GDPR, the draft PIPL does not stipulate that a data controller or processor must have an “establishment” in China. However, aside from one minor exception, it does require that all data processing activities be carried out in China.

The PIPL appears to apply to a data controller or processor’s activities in China even if it does not have an established presence in the country. Alternatively, the PIPL may not apply to a data controller or processor who has an establishment in China, but whose processing activities are not executed in the country.

The PIPL will have extraterritorial applications and cover the following types of processing activities.

  • Collection, processing, and storage of personal information on natural persons within the People’s Republic of China.
  • Processing of personal information of natural persons within China from outside of the country, if such processing is:
    • For the purpose of offering goods or services to natural persons in China
    • To assess the behavior of natural persons in China
    • Other circumstances, as dictated under legal provisions and administrative rules

Essentially, the PIPL applies to and regulates any data processing that happens within Chinese territory and/or related to persons residing in China. If a firm outside of China handles personal information as described above, the PIPL requires it to establish a dedicated institution or designated representative in China for the purpose of dealing with personal information protection issues. It is required to provide the name and contact details of such a facility or representative to the Chinese authorities.


Concerned parties conducting business in China or otherwise processing personal information of Chinese nationals should act swiftly to adapt to the new restrictions if they have not already done so.

Given its extra-territorial application and the necessity to designate a local representative in certain circumstances, compliance with the new PIPL is even more essential for foreign business people operating in China. Similarly, foreign actors must quickly assess whether they qualify as “essential information infrastructure operators” or have crossed the bar of personal data processing in order to develop an IT infrastructure in China.

PIPL compliance is something that impacted businesses should be prepared for, especially if they transfer personal information from China to the United States. Companies in affected industries should assess their existing data privacy policies and procedures for PIPL compliance, as well as make any necessary modifications.

It’s yet to be seen exactly how these protections will be made under the new PIPL once it’s fully established, but we’re willing to bet regulated companies will look to providers like TeraDact to protect their sensitive data. We have two products (Tokenizer+ and Redactor+) in our growing suite, developed just for purposes like this. It’s what we do best.

The Key Tenets of Zero Trust in Technology

With the ever-evolving state of digital security posing endless threats to organizations and their data, innovative solutions are in growing demand and implementation. One of the most notable of these new approaches is that of Zero Trust technology, which seeks to reimagine the way in which network security operates and build from the ground up who has access to what specific data.

Zero Trust is a security architecture that ‘never trusts and always verifies’. It’s designed to safeguard contemporary digital environments by using network segmentation, preventing lateral movement, offering layered protection, and making it easier to apply fine-grained access control. Teradact through our products TokenizerPlus (Tokenizer+) and RedactorPlus (Redactor+) can help any organization with their Zero Trust architecture from the data up.

What is Zero Trust?

​​Zero Trust is a security design concept that assumes everything in a network should be considered untrusted until proven otherwise. The goal is to build systems that cannot be breached by lateral movement (moving within the network) or compromised by malicious insiders.

Zero Trust also emphasizes the need for comprehensive security visibility, so you can see what’s happening in your environment and respond quickly if something bad does happen. Zero Trust makes it easier to implement fine-grained access control, through dynamic segmentation.

To do so, Zero Trust leverages technologies such as multifactor authentication, IAM, orchestration, analytics, encryption, tokenization, redaction, scorekeeping, file system access permissions. The idea of Zero Trust is to minimize the amount of data accessible internally while still allowing users access to whatever they need to get the job done. Our proven technology Tokenizer+ and Redactor+ enable your multi-layered Zero Trust protection framework

1. Unified Coverage

Zero Trust is not limited to a particular environment, such as the cloud or on-premises. It can be used in both types of environments, which is important because so many organizations are now hybrid.

Implementing a Zero Trust network is based on the firm having control of the network. It establishes where lines may be drawn and enforces access controls to protect sensitive applications, such as those running in on-premises data centers, from unlawful access and lateral movement.

Identity-based policies offer greater security that follows the workload wherever it travels, whether it’s in a public cloud, a hybrid environment, a container, or an on-premises network architecture.

Even if applications and services communicate across network environments, utilizing a zero trust approach to protection ensures that they are safe. Tokenizer+ and Redactor+ are fully scalable and deployable in your on-premise and/or cloud hyper-scaler provider and enabled for marketplace deployment.

2. Risk Assessment Capabilities

This security framework employs cutting-edge technologies such as risk-based multi-factor authentication, identity protection, next-generation endpoint security, and secure cloud workload technology to verify a user’s or system’s identity, give access at that time, and safeguard the system. Before they connect to apps, the endpoints and assets must be verified for trustworthiness. Encryption of data, securing email, and verifying the cleanliness of endpoints and assets are all important factors involved.

Through this, systems build stronger access controls that assess and manage the risk of ransomware and insider threats. Tokenizer+ and Redactor+ are able to intelligently leverage access rights to ensure that only the approved individuals are able to access your approved data based on your internal risk assessments

3. Automation

Policies need to be able to change as an environment changes. That’s why automation is so important in Zero Trust.

You need a policy management system that can automatically create and enforce policies as a given environment changes. Zero Trust automation and orchestration capabilities help to manage the secure access processes across an entire organization. This is done through integration with leading security technologies, including IAM, CASB, WAF, and EDR.

This allows for Zero Trust security policies to be automated and enforced as users try to access applications and data. It also allows for the continued monitoring of user activity and the dynamic adjustment of security policies to respond quickly to any risks that are identified. Tokenizer+ and Redactor+ leverage AI/ML to intelligently automated and protect your data whether it’s at rest or in motion

4. Scalability and manageability

Zero Trust Security is designed to be scalable so that it can grow with your organization. You should be able to add users, applications, and devices easily and without disruption. The system should also be manageable, so you can quickly identify and fix problems when they occur. Moreover, your API should be secure in its strategy to ensure that it does not leak your data while protecting it.

To be effective, APIs should not only be isolated from the broader data center environment, but also have strong access controls around them. API traffic should go directly to API gateways without passing through other networks, gateways or server infrastructure first. Data security is important, so API requests must be authenticated and authorized before they are called by a process or a user. Tokenizer+ and Redactor+ leverage the most up to date API and SDK to ensure that all known zero day exploits have been addressed and leverage access rights to ensure only those who are authorized to see the data are able to access it.

5. Ease Of Deployment

Ease of deployment is critical for supporting organizational needs, development and growth. To enable successful implementation, deployment and onboarding procedures must be simple and straightforward. In today’s tech culture, it’s crucial to use a technology that is simple to manage and doesn’t require specialized knowledge.

Tokenizer+ and Redactor+ are designed to be implemented within existing infrastructure and security tools and locally or in the cloud. Instead of requiring a rip-and-replace approach, it’s easy to deploy in an existing data center. Its components can be added incrementally, with full functionality available right away. This makes it ideal for both simple implementation and ease of use.

6. Support For Legacy Systems

A Zero Trust Security policy can also be used to secure legacy systems that are difficult to update or replace. Legacy systems can be isolated and made more secure through the use of micro-segmentation, encryption, tokenization and redaction of data sources. This allows for the continued use of these systems without putting the rest of the organization at risk by protecting the data within those legacy systems themselves. Tokenizer+ and Redactor+ can protect your data within those legacy systems by providing a multi-layered approach to data protection.


In a world where data breaches are becoming more common, it’s important to have a security framework that can protect your organization from all types of threats. Zero Trust is designed to do just that. It employs a risk-based approach that verifies the identity of endpoints and users before allowing access to applications and data. By using this approach, you can be sure that your organization is protected from ransomware, insider threats, data loss and other malicious activities.

Our solutions, Tokenizer+ and Redactor+, are also scalable and manageable, making it ideal for organizations of all sizes. And because it’s easy to deploy, it can be implemented quickly and without disruption. If you’re looking for a data security solutions that can protect your organization from threats, Tokenizer+ and Redactor+ is the answer, and you can improve your security posture and protect your data from cyber threats and further enable your security framework.

What Is Personally Identifiable Information and Personal Health Information?

The 21st century has seen a significant boom in the creation of electronic data, which has led to the digitalization of personal information. Although digitalization has provided significant benefits to companies and individuals alike, such unprecedented growth is not free from problems. The biggest one is issues of cyber security and how to protect your sensitive data. 

As the cyber world expands, so does the rate of cybercrimes. Hackers use new methods to penetrate security systems and use people’s information for various crimes. It is, therefore, Highly advisable for entities to protect their sensitive information, especially when it comes to Personally Identifiable Information and Personal Health Information. 

Two of the most common types of data used to commit largescale cybercrimes. But what data protection measures should one take? And what kind of information must be protected at all costs? Finally, what are the repercussions of not protecting your data? If you have all these questions in mind, then you’ve come to the right place. 

Our comprehensive guide on Personally Identifiable Information and Personal Health Information will answer all of these questions and more for you to understand information security and data protection clearly.

What is Personally Identifiable Information? 

Personally, Identifiable Information has a broad definition. It can include any type of information that can lead to identifying the person the data belongs to through various direct and indirect methods. 

This type of data comprises information that can directly identify the individual, such as their full name, personal address, telephone number, social security number, or any other code employed by institutes and companies for identification, email ID, and social media information. 

Or information that can lead to the identification of the individual through indirect methods. This can include the date of birth, gender, race, geographic location, various other demographics that cybercriminals can identify an individual. 

Any information, whether it is on paper, online, or any device, that can lead to the individual being identified either physically or online is known as Personally Identifiable Information. 

The importance of Personally Identifiable Information can be gauged by the fact that the European Union and various other countries have strict laws and regulations that enforce its protection in most nations; the breach of this type of data is a punishable act. 

An example of a regulation pertaining to violations of Personally Identifiable Information is the European Union’s General Data Protection Regulation that was passed in May 2018 and had a significant impact on the way companies handled the personal information of their employees. 

Under the GDPR, citizens of the European Union have the right to the protection of their data that is given to any company worldwide. Any breach of Information Security that can lead to the leaking of Personally Identifiable Information is heavily penalized unless reported and acted upon immediately (within 72 hours). 

Furthermore, if any company does not adhere to the strict guidelines of GDPR, it can be heavily fined depending on the measure of non-adherence; companies can be fined by up to 4% of their annual revenue. Although the GDPR allows companies to choose their data protection methods, they must be robust enough to offer adequate information security. 

Variations of such laws exist globally. However, the GDPR is one of the most comprehensive regulations to be put into full effect. 

What is Personal Health Information?

Personal Health Information (PHI), also known as Protected Health Information, is health-related information used to identify individuals. Personal health information can include data related to demographics, medical histories, laboratory and other tests, family medical history, health information, and other such data used to identify and treat individuals. 

Like personally identifiable information, Personal Health Information can be accessed and manipulated by criminals to commit various crimes such as identity theft. Digitally stored Personal health information is vulnerable to cyber-attacks if adequate measures of Information Security and data protection measures are not put in place. Cyber security is of utmost importance for companies, institutes, and organizations that deal with and store individuals’ personal health information. 

Although digitalization and having easy access to such data is vital for healthcare professionals to be able to provide quality and urgent care, it can also lead to serious security concerns if there is inadequate cyber security. 

For this reason, there are numerous laws and regulations in place globally to protect such information. Any individual or organization that causes a breach of such data mishandles personal health information of individuals or provides less than accepted information security measures is liable to be punished by law. 

One of the most comprehensive laws to deal with Personal Health Information in the US is The Health Insurance Portability and Accountability Act (HIPAA), which was enacted on August 21, 1996. HIPAA sets out a clear list of indications of what comes under Personal Health Information. 

These indicators can be used on their own or combined with other information to identify individuals. They include:

  • Name
  • Address
  • Any dates specific to the person, such as their admission date, discharge date, birthdate, etc. 
  • Fax numbers
  • Phone numbers
  • Numbers and codes that identify health plans
  • Email ID
  • Medical Record (MR) number
  • License number
  • Social security number
  • Any account number
  • Serial numbers that lead to the identification of devices used by an individual
  • Information that can lead to the identification of their vehicle, such as their number plate
  • IP address
  • Any web addresses specific to the individual
  • Information about characteristics that are unique to them
  • Biometric data of the individual such as their voice ID, fingerprint, or biometric code
  • Pictures of the individual or of personal traits that can lead to their identification

Personal health information is helpful for clinicians, researchers, and organizations for many reasons. Not only does accurate health information help clinicians provide timely and thorough care, but it can also help provide early diagnosis and predictions of the likely discourse the disease may take. 

Furthermore, personal health information can help provide information about general disease trends within the population and current health conditions and care. However, this information can also easily be manipulated and used for personal gains and criminal activity. 

Regulations such as HIPAA help prevent such unlawful activities and hold organizations accountable for how they handle sensitive information. 

Why Is It Important To Protect Personally Identifiable Information and Personal Health Information?

Personally Identifiable Information and Personal Health Information are both data that can lead to serious repercussions if in the wrong hands. This type of data is especially prone to cyber-attacks as it can be used to commit a multitude of crimes. 

One of the most prevalent crimes committed through theft of Personally Identifiable Information and Personal Health Information is Identity theft. 

According to a report by IBM published in 2020, 80% of businesses that were researched reported some breach in the personally identifiable information of their customers. 

As is evident from all the numbers, individuals’ concerns about cybersecurity relating to their personally identifiable information and personal health information are due to good reason. This type of information can lead to a variety of criminal activity including:

  • Credit card fraud
  • Bank fraud
  • Email Ids being hacked and being used for malicious intent
  • Social media accounts being hacked and used for malicious purposes
  • Tax fraud
  • Fraudulent applications for credit or loan

How Can You Protect Personally Identifiable Information and Personal Health Information?

Information security and data protection are of utmost importance in today’s digital world. Following are a few measures individuals can take to ensure their data is well protected:

  • Use of Encryption At Rest and In-Transit when handling datasets with sensitive data
  • Tokenization to overlay or replace the sensitive data with non-identifiable information
  • Redaction of sensitive data so that only the appropriate users may access the data


Despite numerous steps being taken by international communities and global leaders, the genuine looming threat of cyber-attacks exists. 

Any entity found privy to cyberattacks is likely to be penalized heavily by the law and need to make sure that adequate protections have been implemented before an incident occurs.  Teradact’s TokenizerPlus (Tokenizer+) and RedactorPlus (Redactor+) provide intelligent and automated AI/ML based solutions to protect your company’s sensitive data.  Please contact us for more information.

Cybersecurity Is Critical to the Future of Your Business

In some form or another, cybersecurity has always been crucial. Recently, however, and especially during the COVID-19 pandemic, it’s become increasingly important. This is simply because the risk of data breaches and data loss as a result of cybercrime has increased exponentially. And with more people using the internet than ever before, this risk is likely to increase even further.

Because of the increased risk, cybersecurity is critical to the future of your business. Simply put, with an effective information security (Info Sec) strategy, you’ll ensure that your and your customers’ data stays safe.

The problem is, however, that, due to technology becoming more sophisticated and cybercriminals using more aggressive approaches in their attacks, basic strategies are no longer good enough.

As a result, you need a multi-layered approach that protects every part of your network. Why is this important and, more importantly, what should your strategy consist of? In this post, we’ll look at these questions in more detail.

A Brief Look at the Statistics

At the foundation of understanding why cybersecurity is so critical to your business, is understanding the risk. So, it’s important to consider some cybersecurity statistics that illustrate this risk better.

Although cybercrime has always been a problem, its incidence is up by 600% as a result of the COVID-19 pandemic. This is because cyber criminals use the pandemic to go after employees. These employees then download malicious attachments or click on suspicious links. 

Another contributor to this is that remote work has become increasingly popular. Employees working from home often don’t have the same level of security as they have at their offices. This makes it challenging to reduce the risk.

More worryingly is that, when a data breach happens, it takes companies, on average, 207 days to identify it. Also, 43% of data breaches are because of cyberattacks against small businesses. And these are the businesses who simply can’t afford it. 

Yet, despite this, only 16% of companies are prepared to deal with cyber risk and its implications. As such, more than 77% of companies do not have a cybersecurity response plan. Even worse, only 5% of companies’ folders, and by implication their data, is protected.

Why You Need a Layered Approach?

Nowadays, in your business, you’ll use several applications and platforms. You’ll also store and share data in a variety of ways. The thing is cyber criminals are becoming more sophisticated. As such, they’re using more advanced methods of attack to target businesses and the more applications and platforms your company uses the more vectors those criminals have.

This, means that a basic cybersecurity strategy will not be good enough. Firewall and antivirus solution will no longer protect your business. Thus, you’ll need to incorporate a range of technologies in your strategy to ensure that your business’s data stays protected. 

Beyond the security aspects, a variety of data privacy regulations have recently been introduced and when you have a cyber security event these laws apply to the loss of your data. These laws include:

  • GDPR – General Data Protection Regulation
  • CPRA – California Privacy Rights Act
  • PIPL – Personal Information Protection Law

As you’ll likely deal with customer data, your strategy should then not only meet but exceed the requirements of these regulations. If it doesn’t, the penalties for not complying can be severe. 

Data: Digital Gold

Although you may have some tools and solutions to protect your systems from threats, the question is: What happens if a breach or data loss occurs?

This is where our data tokenization solutions come in. TokenizerPlus (Tokenizer+) allows you to confidently apply a multi-layered approach to protecting your data at rest and in transit and protect the underlying sensitive data itself.  As a result, we’re instrumental to your multi-layered cybersecurity solution.

In other words, you need some form of control when this data is outside your network. As a result, you should implement technologies like encryption, tokenization, and redaction that help you to protect your company’s and customers’ data. In turn, this ensures data security and data privacy.

Bottom Line

Considering how technology changes and evolves, basic cybersecurity strategies are no longer good enough to protect your business against the risk of cybercrime. As a result, you need a multi-layered approach that protects every part of your network and ensure data safety and privacy. 

As part of this strategy, TeraDact incorporates TokenizerPlus and RedactorPlus offers a robust solution to secure information sharing. It efficiently checks, versions, and releases sensitive documents to a multi-level access audience and has full tokenization and redaction capabilities. To learn more about TokenizerPlus, or RedactorPlus, and how these tools can help you protect your data against risk, contact us today.