Data and algorithms are the new assets to protect
As individuals, businesses and society at large, we spend more and more time online leaving an ever-growing digital footprint. We transfer data that are condensed into profiles and reveal much about our personalities as well as our political preferences and tastes as consumers. Whoever has access to this data can influence people, steal identities, and cause significant harm.
But data is not only valuable from the point of view of the individual, it is also a key factor of production for businesses operating in the digital space. Whereas classic industrial companies consisted of plants, reactors, halls, and workshops, today’s means of production are algorithms, software, and databases.
That’s why protecting the technical infrastructure is not only important to comply with data protection requirements but also is a fundamental element in safeguarding creation of value in a modern business. If company secrets are spied out, data leaks out, or ransomware paralyzes entire systems, this can easily spell the end of a company.
When protection fails: real-world consequences
Unpleasant consequences of inadequate data protection are not only hypothetical. In August 2024, a ransomware attack disabled the ERP system of the vodka producer Stoli Group. Accounting had to be run by hand, and the group could no longer supply its lenders with current financial reports. Three months later its US subsidiaries filed for Chapter 11 protection, citing the attack as one of the decisive factors. Granted: the confiscation of its remaining Russian distilleries by the authorities in Russia was another. The cyberattack did not, technically, cause that insolvency on its own. But it removed the company’s ability to demonstrate that it was solvent.
In a similar case, a cyberattack on Jaguar Land Rover, beginning at the end of August, halted global vehicle production for roughly six weeks. The UK Cyber Monitoring Centre put the total economic damage at around £1.9 billion and traced ripple effects across some 5,000 businesses in the supply chain, making it the most costly cyber event in British history.
These are not outliers. Furthermore, the structure of those attacks is remarkably consistent. Flashpoint’s 2026 Global Threat Intelligence Report counts 3.3 billion compromised credentials and cloud tokens, harvested from more than 11 million machines infected with information-stealing malware in 2025 alone. The mechanics of cybercrime have moved from breaking in to logging in. The front door was not broken but opened with a stolen key.
Data protection and a reliable corporate IT are one and the same thing
In order to protect not only customer, employee, and supplier data, but also corporate know-how, trade secrets and digital resources and assets, appropriate technical and organizational measures (TOMs) must be implemented to ensure the integrity, confidentiality, and availability of data. Existing safeguards must be constantly monitored for security gaps, and processes must be established to ensure that all systems remain consistently updated at all times.
This shows that companies that practice good technical data protection do also protect their business - they kill two birds with one stone. Data protection, properly understood, is not an “additional task,” not a burden, not bureaucracy, not an addition to the actual business tasks at hand. Rather, data protection is in itself an increasingly important and central function underlying the whole business. And on top of that it is also important to be able to act successfully in the digital sector in the European Union going forward. Especially against the backdrop of increasing uncertainties in international data transfer – for example, with regard to legal developments in the USA – an independent and robust approach to data handling becomes even more important.
With watchdogs growing teeth and consumers taking those things more seriously, compliance with the General Data Protection Regulation (GDPR) and regulatory requirements such as the NIS-2 Directive, and the associated safeguarding of data sovereignty in Europe can become a competitive advantage over other companies that do not comply or only partially comply with the legal requirements.
Beyond mere compliance: protecting trade secrets and limiting personal liability
There is a dimension to data protection that goes beyond regulatory compliance and is often overlooked: the protection of a company’s very own business interests. Weak access controls and compromised identities do not only endanger personal data, but can also expose trade secrets, intellectual property, internal strategies and other sensitive business information.
Under the EU Trade Secrets Directive (2016/943), information qualifies as a trade secret only if its holder has taken reasonable steps to keep it secret. A company that keeps its algorithms, customer databases or proprietary processes on systems without adequate technical protection may find that those assets have lost their legal status as trade secrets altogether. In a dispute it may then have no claim at all – not because the theft was lawful, but because the information was never properly protected in the first place.
The implications extend further. Confidentiality agreements (NDAs) with business partners typically require reasonable measures to protect shared information. If a breach occurs because of weak access controls, the company may face contractual penalties and damages claims from its own partners.
And then there is the question of personal liability. Under most legal systems, management is personally responsible for exercising due care in running the company.. Article 20 of the NIS2 Directive makes the same point explicitly for cybersecurity – management bodies must approve and oversee the risk management measures, may be held liable for infringements, and are required to undergo training. A CEO who dismisses multi-factor authentication as too expensive and then watches credentials get stolen may face uncomfortable questions, and not only from the regulator.
This is particularly relevant in environments where employees, external partners, and service providers access shared systems and confidential resources. Strong authentication and modern identity and access management (IAM) therefore help not only with regulatory compliance, but also with protecting competitive advantages and reducing business risks.
Technical data protection as a secure foundation
Of course, protecting the infrastructure alone is not enough for a company to operate successfully. It is also important to ensure that the organizational framework for data protection is in place and that legal requirements are reliably implemented.
Yes, it is important to have standards for the way paper is shredded so that documents cannot be reassembled. But in a world where a single set of stolen credentials can expose millions of customer records, the paper shredder is no longer where the real battle is fought. The questions that matter today are different ones: Where is data stored, and who can access it? How are identities and access rights managed across systems? What happens when a supplier’s infrastructure is breached? And are the contracts in place to make sure responsibilities are clearly allocated when things go wrong?
Above all these questions, however, we must not forget the technical basis, which is the foundation for all other measures: It is not enough to create only theoretical data protection through elaborate lists and contracts. Businesses must actually practice data protection embedded in the very fabric of the business.
One of the most critical, and most frequently neglected, technical measures is access and identity management (IAM). Who can access which systems, under what conditions, and how is that identity verified? Multi-factor authentication, role-based access controls and modern identity protocols such as OpenID Connect and FIDO2 are not luxuries. They are baseline requirements. We discuss the legal and practical dimensions of authentication in more detail in our article on when multi-factor authentication is advisable and when it is mandatory.
This requirement is further reinforced by new regulatory demands.
- The Data Act (applicable since September 2025) fundamentally changes the landscape for machine data and IoT data in supply chains.
- The EU AI Act sets significant data governance requirements for high-risk AI systems in Article 10. Those obligations now apply from 2 December 2027 for stand-alone high-risk systems, and from 2 August 2028 for AI embedded in regulated products. The transparency obligations in Article 50 were not deferred and have applied since 2 August 2026.
- The Cyber Resilience Act obligates manufacturers of connected digital products to implement security by design from 2027 onwards.
Those who already have robust data protection structures and documented data quality assurance are better positioned for this next wave of compliance. This makes it clear: Technical data protection is not an add-on, but rather the foundation upon which all other data protection measures are built.
Data protection is a sales tool
For companies that are embedded in corporate supply chains or work for government agencies, good data protection is often a prerequisite for being able to do business at all. This is because such market participants have to screen their supply chains due to legal requirements and will only include appropriately well-positioned partners in their supplier list. Compliance, which may even have to be proven through certification, is the ticket to being able to “get in the game” at all.
The most important certifications directly related to data protection are:
- ISO/IEC 27001 (Information Security Management System / ISMS - industry standard and a minimum requirement in many tenders),
- Certification according to Art. 42 GDPR / EuroPriSe (the certification instrument provided for in the GDPR itself, recognized by data protection supervisory authorities and suitable for providing evidence to controllers),
- SOC 2 Type II (primarily in demand in the SaaS environment and by customers with a US or international corporate structure) and BSI C5 (Cloud Computing Compliance Criteria Catalogue of the Federal Office for Information Security - increasingly a requirement in public tenders and for critical infrastructure supply chains).
This dynamic is about to intensify. On 20 January 2026 the European Commission published its cybersecurity package: a proposal for a recast Cybersecurity Act (CSA2) together with targeted amendments to NIS2. The Commission expressly acknowledges that the NIS2 supply chain obligations have produced burdensome and inconsistent supplier questionnaires cascading down the chain, and proposes EU-wide standardisation in response. Under the revised framework, European cybersecurity certification is intended to demonstrate compliance with NIS2 risk management obligations, and authorities would then no longer be permitted to impose separate security audits. Both proposals are still in trilogue, with political agreement targeted for early 2027. For companies that already have their house in order, this is an opportunity. For those that do not, the window is closing.
Secure and reliable Customer Identity and Access Management (CIAM) is a key component in this context, as it forms the foundation for many digital business processes. At the same time, it is a specialized and often overlooked infrastructure task that does not always receive sufficient attention in practice.
As an IDaaS provider, we help companies by offering secure, configurable and scalable cloud based IAM solutions.
If you want to learn more about what is expected of a modern authentication system, have a look at our article on that topic. And if you are interested in how server location and corporate structure affect your data protection posture, we cover that in depth here.
Of course, we are also happy to discuss your specific situation directly. Click here for the contact form.
Note: This article was first published in February 2022 and last updated and corrected in October 2026.