Under Lock & Key

For facility managers, security and IT teams, responsibly protecting this data has become a core part of running safe, compliant and trusted environments. It is an operational concern that affects risk management, compliance and day-to-day decision-making.

Personal data carries risks but collecting it is important to an organization’s security and operations. By following a few best practices, FMs can help ensure their organization’s data remains private and is used only for its original purpose. Organizations do not have to sacrifice data privacy for security.

Transparency around data handling practices plays an important role in building trust with employees, customers and the public. Technology choices can support privacy without compromising operational effectiveness.

The gold standard in security technology is a concept called “privacy by design.” This method intentionally limits the amount of personal data is collected and clearly defines how that data is used. Privacy controls are embedded from the first lines of code to system design and third-party integrations. Privacy-enhancing technologies, such as automated anonymization and masking, help protect individuals’ identities while preserving the operational value of security data.

This concept extends to the day-to-day use of security systems as well. Organizations can implement privacy by design practices by collecting and retaining only the data required for defined objectives. Strong security measures, including encrypting data in transit and at rest, enforcing strong authentication and applying granular access controls, help reduce the risk of unauthorized access.

Protecting the collected data is an ongoing process. It is not a once-and-done responsibility. For IT teams, this means regular system hardening, vulnerability management and timely updates to address cybersecurity risks that could compromise personal information. Treating cybersecurity as a continuous operational responsibility helps maintain a stronger overall security posture.

When selecting a new security solution, look for trusted technology partners. Evaluate vendors based on how they govern personal data, define limits on data use and communicate their privacy practices. Independent security standards and attestations, such as ISO/IEC 27001, ISO/IEC 27017 and SOC 2 Type II reports, provide important assurance that systems and data are properly protected and managed.

Cloud-managed and software-as-a-service (SaaS) deployments can also help organizations stay current with security patches, privacy controls and compliance. Software updates and patches are managed and pushed out by the manufacturer to keep systems up to date. Organizations may want to consider a hybrid deployment approach that allows FM and IT teams to balance scalability, control and data residency requirements across on-prem and cloud environments.

Many stakeholders within a company collect and work with personal data from security and operational systems. FM teams may use data for decisions on space use and maintenance. IT teams monitor for cyber threats and system health. Security departments watch for threats and manage investigations. Other departments, such as legal or HR, also collect and use data linked to security systems.

At every step of the process, people make decisions that can impact data collection and security. Poor data management practices can accumulate privacy debt — risks and liabilities associated with handling personal data without proper oversight.

One way to address this is through a framework that specifies who is responsible, accountable, consulted and informed regarding data collection and security ownership. Start with understanding what data is collected and why. Establish a cross-functional committee of data owners, legal teams and the IT department to ensure nothing important is overlooked. Be clear on why and when each department collects information.

Once a framework is established, organizations can establish joint strategies and cross-departmental guidelines that help ensure privacy and security objectives remain aligned. This could include policies on the information collected and where it is kept. Define an appropriate retention framework to protect stored data is protected and delete it when it is no longer required.

Some departments may advocate for collecting as little information as possible to mitigate the risks of a data breach. Other parties may have their reasons to want more information collected and filed. Compromises could be required, but having a joint plan will help with an overall organizational approach and policy to data protection policy.

It is also important to regularly assess the plan and understand why the organization collects data, where it is stored, how long it is retained and who has access to it. Documenting these practices helps identify policy gaps and support ongoing compliance.

Artificial intelligence (AI) has also had an impact on data privacy. AI-enabled systems can process large volumes of security data in seconds. AI is increasingly used in software to support the analysis of the vast amount of data collected.

As AI becomes a core part of security systems, look for solutions that are designed and used responsibly and transparently, minimizing data risks.

Responsible AI follows three guiding principles:

Choose AI-enabled systems with built-in privacy features to limit and protect access to sensitive information. It is also a good practice to broaden data protection strategies to ensure strong cybersecurity measures, including regular system audits and updates.

As the amount of data collected grows, employees, visitors and customers have the right to know how their personal data is used, shared and stored. Protecting data is an important part of an organization’s overall security policies.

FMs should work with internal teams, system integrators and technology manufacturers to develop and implement strategies that prioritize both cybersecurity and privacy protection. By adopting a privacy-by-design approach and selecting technologies that support privacy regulations, organizations can protect sensitive data while maintaining compliance and security.