Implementing data protection is an ambiguous area of responsibility for too many organizations, and well-meaning truisms like “Security is everybody’s job” do not help the situation.

Long experience in the field across different industries confirms this, whether the businesses in question create software for external customers or only for internal use. 

Given the lack of clarity about who is ultimately responsible for data protection, it is no wonder that so few organizations empower a specific functional team to effectively address this issue.