Q. The Internal Revenue Service was recently the victim of a data breach. How do we protect our personal data when it is required that it be reported to employer and government agencies?
A. Last week, we learned that the IRS had suffered a data breach where identity thieves used a tool on the IRS’ website to obtain prior-year tax return information on approximately 104,000 households. Not only the IRS, but all companies keep some amount of sensitive information in their files either to identify customers or employees.
Beyond customer and staff expectations to keep sensitive data from falling into the wrong hands, businesses have legal requirements as well. Better Business Bureau reminds businesses to put procedures in place to safeguard their customers’ privacy.
The IRS data breach reminds us that no one is completely immune to hackers. While there is no guarantee your company will not become subject to a data breach, businesses can do several things to minimize the risk.
According to the Identity Theft Resource Center, there were over 760 data breaches in 2014, exposing 83,176,279 records. Taking precautions to prevent your customers’ personal data from becoming compromised should be a top priority of every business that collects customer information.
When looking to secure your customers’ private data, BBB recommends the following:
* Determine what makes sense for your type of business. This will be based on the type of data you collect and store, and the kind of resources you have managing that data. If your small business collects information about customers in various formats (e.g., on paper, on computers and online), you should sit down with a team of your employees — an IT person, office manager, anyone who retrieves data, etc. — and discuss these issues together to make sure you consider all viewpoints.
* Inventory your data. Inventory the type of data you collect, store and/or transmit. Inventory how you store your data. Inventory where you store your data for each type and format of customer information. Inventory how data is moved, who has access to it and how to keep it locked up physically and electronically. Consider seeking outside help to identify potential leak points, and speak with a data forensics team or the bank or processor that provides your merchant account services.
* Educate your employees. Keep in mind security technology can only do so much to protect customer data. Developing policies and providing regular training for employees handling customer data is also imperative. Consider adding internal security measures to protect against the possibility of hacking incidents.
* Write it down. Create a written Standard Operating Procedure for your data security measures including checklists you have created, the security measures you are taking and an explanation on why these security measures make sense. Not only will this serve as a great resource for your employees, it will also serve as documentation that your company has taken a good faith effort to protect customer data.
* Set high standards. Require partners and vendors with access to customer data also have the best available protection. Agencies, software firms and email service providers should have the same (if not better) controls as your company. Likewise, if any of your partners store customer data for you, understand exactly how they are securing their information systems and handling access control.
As a business, check out BBB’s updated online guide Data Security — Made Simpler (bbb.org/data-security) for free information on how to create a data security plan.
As an individual consumer, vigilance is key to your protection. Regularly check your credit reports at annualcreditreport.com for unauthorized charges or other signs of fraud. (NOTE: This is the only free credit report option authorized by the Federal Trade Commission.)
Jim Winsett is president of the Better Business Bureau in Chattanooga.