Niraj Mathur, the Managing Director of Protiviti Member Firm for the Middle East, says one of the biggest risks for an organization is to maintain confidentiality for the personal sensitive data of all its stakeholders in accordance with local or global regulations

Please tell us about the security threat landscape in the region.
The threats to Middle Eastern organisations have been increasing in sophistication and complexity. The landscape is directly dependent on the risk exposure the organization has from their technology investments e.g. cloud adoption or adoption of a new application involves new cyber risks. Hackers keep devising newer innovative methods to exfiltrate data, sabotage operations, or extort money. Organizations are prioritizing their investments in Data Privacy, Data Security, Identity, Detection, Response and building a resilient cyber security culture across the organization. A considerable change is that cyber security risks are on the agenda of board members in the Middle East since the impact can be severe.

How does Protiviti help its customers stay safe from such threats?
The cyber security and privacy domains are very diverse and need a deep understanding of the subject whether it is data security, cyber resilience, or the operating model for the security division within an organization. Protiviti has multiple subdivisions within security and privacy, which have dedicated teams working in their area of expertise whether it is data privacy, identity and access, or security strategy. The subject matter experts assist our customers in assessing threats, and their impact on the business, building plans or strategies to mitigate the risk, implementing the remediation activities and governing the entire process to ensure business outcomes are met. We ensure that when engaged with our clients, we assist them in their compliance by increasing their overall security maturity and laying out a clear roadmap for them to consistently overachieve their KPIs.

What were the key findings of your recent “Navigating the State of Data Privacy in the Middle East” study?
Today, one of the biggest risks for an organization is to maintain confidentiality for the personal sensitive data of all its stakeholders in accordance with local or global regulations. In the Middle East privacy has gained prominence due to regulatory compliance, contractual obligations as well as consumer trust. We surveyed around 100 large organizations across the Middle East and we received some very interesting information about drivers, existing governance, budget allocations and the current maturity of data privacy programs.

According to our findings, 56% of respondents cited regulatory requirements as the primary motivator, followed by the imperative to maintain consumer trust and fulfil contractual obligations. However, an in-depth analysis reveals a lack of consistency in data privacy efforts, as program ownership and responsibility are distributed throughout organizations. Specifically, only 27% of organizations have established dedicated data privacy departments, while 40% designate the information security department as primarily responsible for data privacy. As high as 43% of organizations have not even allocated a budget for their data privacy programs with around 47% of organisations reporting a lack of governance of the risk at the board level.

During our survey, it became evident that only 21% of regional organizations have successfully implemented and operationalized their data privacy program with another 29% still in the implementation phase. The biggest obstacles during the implementation phase were cited as “data visibility” with 76% of the organizations voting for the same. This challenge is further compounded by sensitive data being hosted on the cloud.

67% of organizations have concerns over their cloud service providers providing clear visibility of the same in their environments. As a solution, our report emphasizes the importance of organizational leadership in defining clear roles, responsibilities, and governance structures focused on privacy and prioritizing budget allocation for robust data privacy programs. We have highlighted the key steps that organizations can take to ensure a successful data privacy program implementation and operationalization.

What are the existing data privacy laws in the Middle East, and are companies adhering to them?
The Middle East locations have all released data privacy laws with different strategies for enforcement, implementation deadlines, penalties and execution. Organizations across the Middle East have all noted the risks associated with data privacy failures with varying responsiveness mostly in line with the law enforcement strategy of the country. While we see that 21% of organizations have already operationalized their data privacy program, only another 29% are in the implementation and a huge 43% of organizations have not even budgeted for this initiative. That gives a clear idea of the state of data privacy in the Middle East.

What strategies should companies focus on to increase customer trust?
One of the key drivers of data privacy implementation is consumer trust. Buyers buy from companies they can trust their personal data with, specifically with the rampant misuse of personal data nowadays in the Middle East. Companies need to demonstrate transparency, adopt consent management and deletion of personal data upon consumers’ request as a few of the measures. It is important to identify the owner within your organization and ensure adequate governance over internal or third-party partners to ensure sensitive data is not being sold in the markets. Data Privacy programs when implemented and operationalized ensure that your consumers’ trust is optimum.