A data privacy program is best built centrally within an enterprise to establish a pervasive culture of privacy that is consistent with the organization’s risk appetite. At first, most businesses considered compliance with data privacy regulations to be a “one and done” project. Now, organizations recognize that data privacy is an ongoing effort, best organized as a program to monitor for and respond continually to new data types and new compliance obligations.

This article provides an overview of data privacy regulations and explains what steps organizations must take to operate an effective data privacy program.