On-Demand Webinar · 54 min

Optimize Data Privacy and Security with DataSecOps

Peter Lancos and Sonal Rattan of eXate Technologies join Chris Bergh on the what, why, and how of DataSecOps: how it relates to DevOps and DataOps, how it resolves the conflict between data privacy and data access, and how it simplifies test data management. Recorded September 2020; updated August 2026.

Presented by Chris Bergh

What you'll learn 6 points
  • DataSecOps, as eXate presents it in this session, bridges the gap between operations, governance risk and compliance, security, and data teams, the same move DevSecOps made between security and development teams. The aim is to automate privacy by design and cyber controls into both new and existing applications.
  • The list of parties with a claim on how data is used is long: chief data officer, chief information security officer, data protection officer, compliance, legal, technology, operations, the person the data belongs to, and the jurisdiction the data belongs to. Today that policy gets interpreted and applied by the data engineers and data scientists, which is where it breaks down.
  • The regulatory map is the reason automation is needed. California's Consumer Privacy Act came into force in July 2020 and Brazil's LGPD in August 2020, alongside GDPR in the EU, Singapore's PDPA, South Africa's POPIA, Australia's Privacy Act, Canada's Digital Privacy Act, and drafts in India, Chile, Argentina, Kenya, Uganda, and New Zealand.
  • eXate describes its product as an aggregator of privacy enhancing technologies with governance and controls embedded in the DataOps pipeline, covering PII discovery, access management, record retention, data destruction, right to be forgotten, subject access requests, and audit of use, on the argument that no single protection technique fits every case.
  • The first DataKitchen use case is deploying data security rules as code. Authentication and authorization rules move to production at the same time as the new schema, new data, updated model, updated report, and updated catalog they govern, instead of being applied by hand afterwards.
  • The second DataKitchen use case is test data management. Data and analytic teams need test data that is recent, accurate, reflects production, and does not break local privacy rules, and the three challenges are distribution, meaning the time to operationalize it; quality, meaning high fidelity; and security, meaning private information such as credit cards and medical records.

Slides

38 slides

Questions from this session

What is DataSecOps?

DataSecOps is the practice of automating data privacy and security controls into data pipelines rather than applying them by hand after the fact. In this session eXate defines it as bridging the gap between operations, governance risk and compliance, security, and data teams. It sits alongside the other DataOps areas such as ModelOps for data science and AnalyticOps for self-service BI, and maps to the data governance and security function.

How does DataSecOps differ from DevOps, DevSecOps, and DataOps?

DevOps uses automation to speed integration, test, and deployment of code. DevSecOps adds security to that, bridging security and development teams. DataOps applies the same automation to data sourcing, quality, and cleansing. DataSecOps is the fourth square in that grid: automation that brings governance, risk, compliance, and security into the data pipeline itself.

What are privacy enhancing technologies?

Privacy enhancing technologies, or PETs, are the techniques that protect sensitive data while keeping it usable, such as masking, anonymization, and tokenization. The argument in this session is that no one type fits all cases, so a DataSecOps platform aggregates several and applies them consistently, together with PII discovery, access management, record retention, data destruction, and audit of use.

Why should data security rules be deployed as code?

Because the thing they govern changes at the same time. A release that adds a schema, loads new data, updates a model, refreshes a report, and updates the catalog also changes who should be allowed to see what. Treating authentication and authorization rules as code and deploying them alongside the rest keeps production permissions matched to production content, instead of leaving a window where new data sits under old rules.

Why is test data a privacy problem?

Development environments need test data that is recent, accurate, and reflects production, and the shortest route to that is a copy of production, which carries credit card numbers, medical records, and everything else a privacy regulation covers. The three test data management challenges are distribution, the time it takes to operationalize the data; quality, the fidelity required for the tests to mean anything; and security, minimizing risk without slowing the team down.

Which privacy regulations does a global data team have to satisfy?

As of this 2020 session the map includes GDPR in the EU, the California Consumer Privacy Act in force from July 2020, Brazil's LGPD from August 2020, Singapore's Personal Data Protection Act, South Africa's POPIA, Nigeria's Data Protection Regulation, Australia's Privacy Act and its 13 privacy principles, Canada's Digital Privacy Act, and China's Personal Information Security Specification, with bills in drafting in India, Chile, Argentina, Kenya, Uganda, Thailand, and New Zealand.

Where to go next