BigID

Protecting sensitive customer data has become a central challenge as privacy laws and initiatives expand globally. GDPR empowers Europeans to control personal information held by organizations, while APEC’s Cross-Border Privacy Rules aim to build consumer trust as data moves between APEC economies by requiring privacy policies aligned to the APEC Privacy Framework. In the US, high-profile breaches and scandals have accelerated state-level regulation: Vermont now requires data brokers to register, disclose what they collect, provide opt-out mechanisms, notify people of breaches, and enable legal recourse for misuse. California’s Consumer Privacy Act was enacted with an effective date in 2020, and rising momentum may eventually drive a more uniform federal law.

Additional sector regulations include the NY DFS Cybersecurity Regulation (23 NYCRR 500), requiring regulated New York financial institutions to assess cybersecurity risk and maintain audit trails, with data retention reduced to three years versus a prior five-year standard. These overlapping requirements create compliance pressure: organizations must locate where user data resides, categorize vulnerability and risk, and demonstrate compliance across multiple regimes. Traditional Identity Governance and Administration, originally shaped by SOX-driven separation of duties, covers only part of the broader data compliance problem.

BigID addresses this gap through its Data Intelligence Platform, which discovers, categorizes, maps, and inventories identity-related data at scale across 60+ out-of-the-box data-source connectors. Using ML/AI capabilities such as classification, entity resolution/correlation, metadata capture, and identifiability scoring, it builds an indexed inventory and dashboards (including country-based and world-map views), supports exports for tools like OneTrust, and enables policies and workflows for access intelligence and remediation. The platform emphasizes privacy by hashing rather than storing personal data, offers data-flow visualization and access request reporting for audits, and integrates via microservices APIs with partners like AWS, Microsoft, ServiceNow, and others. Strengths include strong intelligence, connectors, and visualization; challenges include a smaller partner ecosystem, somewhat coarse-grained policies, and no current blockchain data-source support.

• GDPR gives Europeans the right to control personal information collected by organizations.
• APEC initiated Cross-Border Privacy Rules to build trust as individuals’ data flows between APEC economies.
• The APEC CBPR approach requires participating organizations to implement privacy policies conforming to the APEC Privacy Framework.
• Vermont requires data brokers to register with the government and disclose opt-out methods, what is collected, and breach occurrences.
• Vermont’s law provides individuals legal recourse when their data has been abused.
• The California Consumer Privacy Act was enacted and was set to take effect in 2020.
• NY DFS Cybersecurity Regulation (23 NYCRR 500) applies to regulated New York banks, insurance companies, and other financial services institutions.
• The NY DFS regulation includes audit trails showing data retention for three years rather than a previous five-year retention standard.
• BigID was founded in 2016 and reports 7x year-over-year growth performance.
• BigID is headquartered in New York with offices in Tel Aviv, London, Stockholm, Zurich, Singapore, and São Paulo.

• “One of the fundamental issues an organization needs to address, in regards to user data privacy, is understanding whose data you have.”
• “IGA only covers a subset of the data compliance requirements.”
• “A comprehensive solution is needed that uses data intelligence to provide governance, privacy, and protection of customers data.”
• “BigID doesn't actually store the personal data, but rather everything is stored as a one-way hash.”
• “The platform determines identifiable attributes queried from a given data source as well as the likelihood of identifiability (e.g. 100% identifiable).”
• “These policies control what happens when access is given to an object, a file or a data source.”
• “This graph like diagram can be pulled directly from data in the platform’s inventory.”
• “Reports can be created regarding a subject’s access or on a particular individual or attribute such as the individual’s data use consent for a GDPR compliance audit as examples.”
• “Since the BigID Data Intelligence Platform's underlying architecture uses microservices, each of its microservice components provides an API that can be utilized by these other services.”
• “Overall, the BigID Data Intelligence Platform provides a consolidated tool for getting a handle on an organizations data compliance needs and is worth an evaluation.”