Ten minutes. That is how long a firewall was deactivated during an ElasticSearch migration before malicious actors accessed more than five billion data records. The breach did not result from a sophisticated attack. It resulted from a momentary deviation from established security protocols during a routine infrastructure transition. The consequences were financial and reputational, and addressing them required sustained effort across legal, operational, and communications functions.
For B2B leaders, this incident highlights a point that is difficult to dismiss: data protection is no longer primarily about defending against external threats. It is about maintaining a governance framework that holds across every stage of the data lifecycle, including the moments when systems are most exposed, such as during migrations, transitions, and decommissioning. This article explores what that framework looks like in practice, from legal compliance and security requirements to cloud migration risks, data destruction, and the human factors that determine whether any of it works.
The Legal Foundation: What Data Protection Compliance Actually Requires
The General Data Protection Regulation (GDPR) sets the baseline for how enterprises must handle personal data across its entire lifecycle. It requires clear definitions of who is responsible for data at every stage, transparent documentation of how data is collected and used, and deletion of data as soon as its original purpose is fulfilled. These are not aspirational standards. They are enforceable obligations, and violations carry penalties of up to EUR 20 million or 4% of global annual revenue, whichever is higher.
National frameworks add further complexity. For example, Germany’s Federal Data Protection Act imposes additional requirements on how businesses manage and audit personal information, creating compliance obligations that go beyond what the GDPR alone demands. For multinational organizations, this layered regulatory environment means that a single data handling decision can trigger obligations across multiple jurisdictions.
Companies that treat these requirements as administrative overhead rather than operational imperatives may find themselves less prepared when breaches occur. Non-compliance carries real consequences: financial penalties, reputational harm, and depending on the circumstances, criminal liability for individuals involved.
Security Requirements: Technical and Organizational Controls That Must Work Together
Knowing what the law requires is the starting point, but knowing how to meet those requirements operationally is where most organizations find the real work begins. Regulatory compliance sets the legal floor. The security baselines and implementation controls that sit above it define how data is actually protected day-to-day, covering both technical configurations and the organizational behaviors that support them. Neither works in isolation.
On the technical side, data protection demands encryption for all data in transit and at rest, particularly when information moves across public networks or resides in external systems. Authentication controls must be rigorous: user accounts should lock after repeated failed login attempts, and access credentials must meet complexity standards that reflect the sensitivity of what they protect.
Security frameworks favor continuous monitoring and risk-based patching schedules that help enterprises identify, assess, and address vulnerabilities before attackers can exploit them. It’s about aligning enterprise-wide vulnerability management with the sensitivity of the systems and data involved.
Organizational controls are equally important. The need-to-know principle must govern all data access, meaning employees interact only with the data required for their specific role. Applications that pose data collection risks should be restricted on corporate networks. When a potential breach happens, personnel must escalate immediately, without delay, to ensure the company can meet its legal notification obligations and limit damage.
Ultimately, these requirements shift responsibility from a single team to the entire organization. Data protection is weakened when it sits exclusively within IT. When employees at every level understand what is expected of them and why, the overall security posture improves. The next phase of the data lifecycle, cloud migration, is where that posture faces the test.
Cloud Migration: Managing the Period of Greatest Exposure
Cloud migration creates a higher risk window. As systems move between on-premises and cloud environments, data passes through new network paths and security configurations. This allows multiple entry points for compromising data protection, especially if controls are relaxed or gaps appear during the transition.
The five billion record breach described in the introduction occurred during this period. Common failure points include misconfigured access controls, lack of planning, temporary security gaps created when legacy systems are taken offline, and data interception during periods when encryption or firewall protections are suspended.
To manage this, data protection teams should have a structured approach to cloud migration, which can include the following:
Conduct a thorough assessment of existing data before migration begins, distinguishing critical data from obsolete records that should be deleted rather than transferred
Use migration assessment tools to document the current state of databases and identify risks before transition
Apply the principle of least privilege strictly throughout migration, limiting access to personnel who are fully briefed on security requirements
Maintain continuous monitoring during the transition, with immediate escalation protocols for any anomalies
Complete decommissioning of on-premises infrastructure after migration, including a documented plan for the physical removal and sanitization of hardware
Engaging certified IT asset disposal vendors for physical media can help reduce the risk of decommissioned equipment becoming a data liability after the migration is considered complete.
Data Destruction: The Phase Most Companies Get Wrong
Beyond the risk of cloud migration, data destruction is one of the most essential phases for data protection compliance. Yet it is easily overlooked throughout the data lifecycle. When hardware is retired without verified destruction, the data it contains remains recoverable.
According to Blancco’s 2026 State of Data Sanitization Report, 32% of organizations that experienced a data leak attributed it to redeployed drives or devices that retained sensitive data. That finding suggests that confidence in decommissioning processes does not always translate into effective data protection in practice.
True data destruction means ensuring information cannot be recovered, whether through physical destruction, degaussing, or cryptographic wiping carried out to recognized standards, such as those published by the National Institute of Standards and Technology.
The chain of custody between decommissioning and destruction is equally important. Assets must be tracked from the moment they leave operational use until they are destroyed, using tamper-evident containers, logged handoffs, and, where appropriate, logistical transparency. A complete, accurate, and immutable audit trail supports a more defensible compliance position and reduces the risk of being unable to account for retired assets during a regulatory review.
Businesses should prioritize partnerships with vendors holding recognized destruction certifications such as NAID AAA, which can support their ability to demonstrate that the destruction process meets regulatory expectations
Third-Party Risk: Data Protection Extends Beyond Organizational Boundaries
On top of that, sharing data with external partners does not transfer data protection responsibility. Under the GDPR, the primary data controller remains accountable for the actions of its processors, regardless of where those processors are located or how the relationship is structured.
Marsh’s 2024 research found that 70% of organizations experienced at least one material third-party cyber incident in the past year. For most businesses, that makes third-party relationships one of the direct data protection exposures they carry.
Managing that exposure starts with formal data protection agreements that reflect the actual risk profile of the data being shared, not generic templates. Where data moves outside the European Economic Area, standard contractual clauses and equivalent safeguards are required to maintain protection standards under local laws.
Ongoing monitoring and periodic audits verify that third-party controls remain effective and that vulnerabilities are identified before they become incidents. An organization’s data protection posture is only as strong as what it can verify across its vendor ecosystem.
The Human Factor: Where Data Protection Succeeds or Fails
Technical controls and legal frameworks create the conditions for data protection. Human behavior determines whether those conditions are maintained. Research from the Verizon 2026 Data Breach Investigations Report indicates that the human element was involved in 62% of breaches. Training, culture, and accountability are not supplementary to a data protection strategy. They are central to it.
Effective training must go beyond annual compliance checkboxes. It needs to be role-specific, reflecting the actual data handling responsibilities of each employee, and regularly updated to reflect evolving threats. Phishing simulations, clear escalation procedures, and practical guidance on handling sensitive information in daily workflows are all components of training that change behavior.
Organizational policies should also reinforce what training teaches. Clear guidelines on personal device use, remote work security, and document handling give employees a practical framework for decisions they make every day. Leadership communication that treats data protection as a shared value, rather than an IT department function, helps reinforce that framework at every level.
The businesses that have transformed data protection from a compliance obligation into a cultural norm are the ones where employees understand what is at stake and feel accountable for their role in maintaining it. That cultural shift does not happen by accident. It requires sustained investment in communication, training, and leadership visibility.
Conclusion: Data Protection Is an Operational Imperative, Not a Compliance Exercise
Enterprises that have built comprehensive data protection frameworks across the full lifecycle tend to be in a stronger operational position. Their data may be more trustworthy, which can support faster and more confident decision-making. Their controls may reduce the frequency and severity of incidents, which in turn reduces the time and resources spent on breach response. Their documentation is more likely to be current and defensible when regulators ask questions.
But businesses that have not built these frameworks carry exposure that tends to go unnoticed. Decommissioned hardware sitting in a storage room. A third-party vendor without a data protection agreement. A migration conducted without continuous monitoring. Each of these represents a gap that does not make itself visible until an incident forces it into view.
For data protection leaders who have not yet addressed these gaps systematically, the risk is real and specific. Regulatory requirements are becoming more detailed. Enforcement is becoming more consistent. The technical sophistication of threats targeting transitions, migrations, and decommissioning continues to develop. Treating data protection as an ongoing operational discipline reduces the likelihood of being caught unprepared when regulatory scrutiny increases or an incident occurs.
WordsCharactersReading time
