According to a recent Gartner report, "Let Go of Personal Data Without Losing Control," by 2019, 90 percent of organizations will have personal data on IT systems they don't own or control.

"As the amount of personal information increases multifold, individuals and their personal data will increasingly become a security target," Carsten Casper, research vice president at Gartner, said in a statement. "And, yet in most scenarios the organization is still ultimately accountable for the personal data on its IT systems. The time has come to create an exit strategy for the management of personal data. Strategic planning leaders will want to move away from storing and processing personal data in the next five years."

The research firm suggests five key steps organizations should take in order to do so:

  1. Create clear delineations between personal and nonpersonal data
  2. Put a fence around personal data
  3. Favor purpose-built over general-purpose applications
  4. Adhere to privacy standards, or create your own
  5. Logical location should rule over physical and legal location

"The PCI Data Security Standard (DSS) requires the implementation of stringent controls of those who collect and store credit card data," Casper added. "In response, many companies have decided to eliminate credit card data from their own systems and completely entrust it to an external service provider. The same could happen with personal data. If control requirements are too strong and implementation is too costly, it would make sense to hand over personal data to a specialized 'personal-data processor.'"