Cybersecurity and data protection: what to demand from IT and suppliers to reduce legal risk
Cybersecurity and data protection are two critical aspects for operational continuity, regulatory compliance, and decision-making.
Every decision regarding infrastructure, suppliers, data usage, or AI adoption has direct implications in terms of legal risk and reputation.
The Data, Security, Architecture, and Legal teams face a common challenge: to translate abstract principles into concrete requirements, both for a company's internal teams and for third parties.
It is not enough to comply with regulations or have controls; it is necessary to be able to demonstrate, audit and sustain those controls over time.
This approach aligns with a comprehensive vision of data governance, where security, privacy and responsible use of data are part of the same decision-making system.
Similarly, it takes on special relevance in the processing of personal data, where the regulatory framework and user expectations are becoming increasingly demanding.
What does cybersecurity protect and what does data protection require?
In many organizations, cybersecurity and data protection are managed as separate domains. However, in practice, their boundaries are increasingly blurred, and their interdependence is total.
- The cybersecurity It focuses on protecting systems against unauthorized access, attacks, or failures. Its objective is to ensure that information is available when needed, that it is not altered without authorization, and that it is not exposed to unauthorized actors. It constitutes a layer of defense over the infrastructure and digital assets.
- The data protection, Instead, it focuses on the legitimate use of information, especially when it comes to personal data. Define what can be collected, on what legal basis, for what purpose, and under what conditions. Furthermore, it establishes rights for data subjects and obligations for those who process them.
The problem arises when these two worlds are not integrated. An organization may have high standards of technical security but be violating regulations due to the misuse of data. Or it may have defined privacy policies but lack the technical controls to enforce them.
The current challenge is to strengthen to integrate cybersecurity and data protection within a single governance model, where every decision about data simultaneously consider security, compliance, and business value.
Obligations in the event of an incident: notification, evidence and timeframes
Security incidents are a statistical certainty. The difference between mature and immature organizations lies not in their ability to prevent incidents, but in how they respond when they occur.
From a legal and operational perspective, there are three dimensions that must be defined before an incident occurs. Together, these three elements transform incident management into an organizational, not just a technical, capability.
1. Notification
The ability to notify in a timely manner is critical. Regulations typically establish specific timeframes—in many cases between 24 and 72 hours—for reporting incidents involving personal data.
This implies that the organization must have previously defined the communication channels, the responsible parties, and the criteria to determine if an incident is reportable.
It's not just about meeting a deadline: a late or incomplete notification can amplify the legal and reputational impact.
2. Evidence
Without evidence, there is no possible defense. The traceability of what happened—logs, access records, changes, and data flows—is what allows us to reconstruct the incident, understand its scope, and demonstrate that the correct actions were taken.
This requires not only technical tools, but also clear policies for recording, retaining, and accessing information. In complex environments, where multiple systems and providers are involved, traceability must be comprehensive.
3. Incident Management
The operational response must be orchestrated. This includes incident containment, mitigation of its effects, impact assessment, and documentation of all decisions made.
Furthermore, coordination between departments—security, IT, legal, communications, and business—is crucial. Without an integrated approach, responses tend to be fragmented, increasing risk.
Consent: how to manage and prove it
Consent is one of the pillars of personal data processing, but also one of the most underestimated from an operational point of view.
Many organizations treat it as a formal requirement, when in reality it is a critical asset that must be auditable.
For consent to be valid, it must be freely given, specific, informed, and verifiable. This means that the user must clearly understand what they are agreeing to and have a genuine opportunity to choose.
From an operational point of view, this translates into the need to record evidence:
- When was consent given?.
- Under what conditions?.
- Which version of the legal text?.
- Through which channel?.
This is vital information for defending the use of data in the event of an audit or a claim.
Besides, consent is not static. It must be easily revoked, and the systems must be able to reflect that cancellation in all processes that use that data.
In AI scenarios, this point becomes even more complex. The use of data for training, tuning, or inference requires that consent explicitly cover those purposes. Otherwise, the organization may be misusing data, even unintentionally.
Cloud providers: what to ask for in contracts and SLAs
The growth of the cloud model and outsourced digital services has radically changed the risk landscape. Today, much of the operation and data processing takes place outside the organization, in the hands of third parties.
This implies that the contract ceases to be a commercial document and becomes a tool for risk control and management.
One of the most important aspects is the shared responsibility model. Not all providers cover the same areas, and it is essential to understand what part of the security responsibility lies with the provider and what part with the organization. This definition must be explicit.
It is also crucial that SLAs include security aspects, not just availability. Incident response times, service levels for vulnerability management, and notification commitments are elements that must be clearly defined.
Data location and international transfers are another critical point, especially in strict regulatory contexts. Knowing where the data is located and under what jurisdiction it is processed is fundamental to assessing the risk..
Finally, the chain of third parties—sub-processors—must be transparent. Each additional link introduces a new point of risk that must be assessed and controlled.
AI and personal data: risks and minimal controls
The accelerated adoption of artificial intelligence solutions introduced new layers of complexity into data management.
The speed at which these technologies are implemented often exceeds the capacity of organizations to govern them adequately.
One of the main risks is the use of personal data without a clear legal basis, especially in model training or tuning processes. This is compounded by the possibility that sensitive information may be exposed through generated prompts or responses.
The lack of traceability is another challenge. In many cases, it is difficult to explain how a model arrived at a particular decision or what data influenced that result. This is not only a technical problem, but also a regulatory one.
To mitigate these risks, it is necessary to establish minimum controls. These include:
- Define clear policies on the use of AI with personal data.
- Ensure traceability of datasets, models, and decisions.
- Rigorously evaluate technology providers.
It is also important to implement isolation mechanisms to prevent data leakage into uncontrolled environments, such as public models or external APIs without sufficient guarantees.
In short, AI does not eliminate existing obligations: it amplifies them and makes them more demanding..
Legal and operational checklist for purchases and security (minimum clauses and controls)
This checklist translates security and privacy principles into concrete criteria that can be applied in purchasing, contracting, and auditing processes. Its value lies in converting abstract concepts into verifiable requirements.
1. SLAs and explicit responsibilities (RACI). Defining who is responsible for each aspect helps avoid gray areas. When an incident occurs, a lack of clarity in roles is often one of the main problems.
2. Defined international data location/transfer. Knowing where data resides and is processed is key to assessing regulatory compliance and exposure to legal risks.
3. Incident notification (deadlines, channel, evidence). Establishing these elements at the contractual level ensures that the supplier will act in line with the organization's regulatory needs.
4. Security audits / reports (frequency). Access to reports and the ability to audit allow verification that controls not only exist, but also work.
5. Encryption in transit and at rest + key management. Data protection must cover its entire lifecycle, including who controls the encryption keys.
6. Subprocessors and declared third-party chain. Transparency in the supply chain is essential to avoid hidden risks.
7. Data retention/deletion and return at contract termination. Defining what happens to the data at the end of the relationship prevents future problems and ensures compliance with minimization policies.
8. Controls for the use of AI with personal data (policy + tooling). InExplicitly incorporating the use of AI within contracts allows for anticipating and managing emerging risks.
Next steps
For many organizations, the challenge is not understanding what needs to be done, but how to start in an orderly and impactful way.
An effective first step is to conduct an assessment to identify gaps between the current situation and the required standards. This includes reviewing contracts, evaluating existing controls, and mapping risks in the supply chain.
From there, it is possible define an action plan with quick wins, For example, contractual adjustments or improvements in evidence management, and a broader roadmap for Strengthen data governance, security, and privacy.
Schedule a security, privacy, and data workshop with our team.
