Privacy and Protection of PII
Description
The organisation shall identify and meet the requirements regarding the preservation of privacy and protection of personally identifiable information (PII).
⚠️ Risk Impact
PII handling without privacy controls produces GDPR, CCPA, DPDP, and PIPL exposure simultaneously. Modern privacy regulations carry penalties materially higher than security regulations.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
Maintain PII data inventory. Apply data minimisation (collect only what's necessary). Implement DSR (Data Subject Request) handling: access, correction, deletion. Privacy by Design in new product features.
💀 Real-World Attack Scenario
A SaaS company collected employee diversity data 'for HR analytics' without documented purpose limitation. When an audit asked 'why this data?', the team had no answer. GDPR Article 5(1)(b) purpose-limitation violation; €1.8M penalty. The data wasn't necessary; it had been collected because 'we might use it someday'.
💰 Cost of Non-Compliance
GDPR violations: up to €20M / 4% revenue. CCPA violations: $2,500 per record. DPDP violations: up to ₹250 crore.
📋 Audit Questions
- 1.Show the PII data inventory.
- 2.What is the documented purpose for each data category?
- 3.How are Data Subject Requests handled? What is the SLA?
- 4.Show Privacy by Design evidence for last 3 product features.
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Collecting data without documented purpose ('we might need it')
- ⛔Manual DSR handling — slow, error-prone
- ⛔Privacy as legal-only function — engineering teams unaware
📈 Business Value
Strong privacy controls reduce regulatory exposure across multiple jurisdictions simultaneously. Increasingly material for B2C and B2B-with-individuals products.
⏱️ Effort Estimate
60-120 hours PII inventory + DSR program + Privacy by Design integration
EchelonGraph integrates PII detection + classification across cloud + SaaS
🔗 Cross-Framework References
Automate ISO 27001 A.5.34 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →