Here's how you can handle sensitive data-related tasks with care.

CCPA & GDPR are the common compliance requirement for Personal Identifiable Information (PII). You got to work with Data Privacy Officer (DPO) who responsible for ensuring that an organization complies with data protection laws and best practices. Do not attempt to interpret the various data privacy laws yourself. The law is different in each jurisdiction. DPO is you best person to consult on the PII protection.

In my experience, the first step to protect sensitive data is to identify and label them throughout the data lifecycle. On top of Personal Identifiable Information (PII) we also need to restrict specific project data access to US person only. This data classification and protection effort required organizational change, company wide education and isolated the infrastructure, network firewall, application and data access. This was implemented way before the GovCloud concept exist of the Cloud service providers. The availability of GovCloud services should make thing simple to secure the data of US Government project.

Based on my experience, we should take below steps. 1. Access Control: Implement strict access controls and authentication mechanisms to ensure only authorized personnel can access sensitive data. 2. Data Encryption: Encrypt sensitive data both at rest and in transit to protect it from unauthorized access. 3. Authentication : Add multiple factor authentication. 4. Training for security : Provide training to employees for Data security and privacy. 5. Avoid to store sensitive information in local.

Next the data access control has to be well designed prior to the data merge. It is not advisable for any individual to have read and write all data across any system. The recommended way is to adopt role-based access control. Data access roles should be assigned to individual or group of users. With the possibility to assign multiple roles to a single group. Best practice is to assign roles to a group even if only a handful of users need it. This allow flexibility of add or remove individual from a group with multiple roles assigned. Furthermore, it is practical to design read access based on the organizational hierarchy. This ensures secure and structured data access.

Encrypting data, both in transit and at rest, is a fundamental aspect of data protection to prevent unauthorized access. At a minimum, the Advanced Encryption Standard (AES) with a 256-bit key should be used for data at rest, and Transport Layer Security (TLS) for data in transit. The National Institute of Standards and Technology (NIST) provides good resources on data encryption standards.

To audit your data, processes, systems and procedures; you must have an integrated monitoring ecosystem in all these assets, as well have all documentation related with applied regulation, law and standards!

Start by implementing robust data encryption both at rest and in transit to protect data from unauthorized access. Adhere to relevant data protection regulations, such as GDPR or HIPAA, ensuring compliance through regular audits and updates to your data handling policies. Employ strict access controls, granting permissions only to those who absolutely need it, and use multi-factor authentication to secure access points. Maintain a detailed data inventory to track sensitive information and its flow within your systems. Train your team on data security best practices and the importance of handling sensitive information with care.