The volume of data is growing rapidly. As we wrote in last week's article, 64.2 zettabytes of data were created in 2020, and this is expected to reach a staggering 181 zettabytes by 2025. It is even said that there are more bytes worldwide than grains of sand. This increase leads to a growing need to keep data under control. Reflecting on this is also important for your organization, as it determines which Cloud is the best fit. How? You can read about it in this article.
A century ago, oil was the most important global commodity. Today, data is seen as the oil of the digital age. Thanks to the massive increase in data volume, data is becoming increasingly valuable to organizations. Just look at companies like Google and Facebook, which earn their money primarily from user data. For example, Facebook earned $15.49 per quarter per European user in 2021, while users themselves barely know what is being done with their data(1). With 408 million European users every month alone, that is quite a business model.
Better control over your data through data classification
This is the second article in a four-part series in which we discuss sovereign Cloud, data classification, and Cloud strategies.
Have you ever thought about what is worse for your organization: the fact that IT is unavailable or the fact that you can no longer trust your data? And have you ever considered the value of data within your organization? Suppose this data is unavailable or leaked due to a cyberattack; what would the consequences be?
The fact that data is increasingly becoming a business model for criminals is also evident from the explosive rise in cyberattacks. For instance, the number of cyberattacks on Dutch municipalities increased sharply in 2021, and it is notable that cybercriminals do not hesitate to publish privacy-sensitive information of residents, companies, and employees online(2). The result? Disaster Recovery is increasingly focused on cyberattacks rather than, for example, power outages. A study by IDC among American and Western European organizations showed that in 2021, no less than 79% of these organizations relied on a Disaster Recovery solution, with 61% of cases involving a ransomware attack or other form of malware(3). As a result, concern has increased enormously, and more and more questions are arising regarding data privacy, such as: where is my data actually stored? And who can actually access it? Trust in data handling must increase. But how? The first step in this is data governance (laws and regulations).
The first major step toward data protection was taken in 2018. We wrote the following about this in an earlier blog post: the General Data Protection Regulation (GDPR), which came into effect within the European Union in 2018, has ensured much stricter handling of privacy-sensitive and personal data. Individuals have the right to have privacy-sensitive data protected, but also accessible to them so they can view it and decide whether data should be adjusted or deleted. In addition, there is increasing legislation in the field of data sovereignty: personal data falls under the legislation of the sovereign state in which the data was produced. In other words, if a Dutch citizen creates data or leaves their information somewhere from the Netherlands, it is protected by Dutch (and EU) privacy rules. A central aspect of this legislation is the physical location of the data, or data residency: many countries require organizations operating in a specific country to store data about residents on servers located within national borders.
Governance in the field of data protection is therefore an ongoing process; for example, the EU Data Act(4) may come into effect by mid-2025, and the arrival of NIS2(5) is intended to increase the data resilience of organizations. In addition to following these rules, you can also ensure that you keep your data under control yourself.
How? Through the second step: classifying data. Data classification is simply assigning a certain value to data to determine the level of protection required. We currently see organizations classifying data based on, for example, confidentiality and business impact in the event of data loss. There are many different types of data, all of which can land in a different type of Cloud, each with its own level of protection and certifications. To protect your most critical data, you might best choose a sovereign Cloud. Data sovereignty therefore actually begins with data classification, in order to provide specific guarantees regarding matters such as data residency and protection.
According to the VMware Sovereign Cloud Framework, there are four different types of data: secret, restricted, protected, and public data. At Fundaments, we also use this framework in our advice when implementing Cloud solutions.
Are you curious about which phase of data sovereignty your organization is in? Take a look at the image below!
The next step is determining the right Cloud, tailored to your data classification. You can read more about this in next week's article.
Sources:
(1) Tweakers
(2) NOS
(3) ICT/Magazine
(4) Government of the Netherlands
(5) Digital Government
