BigID

Protecting sensitive customer data has become a defining compliance and risk challenge as privacy laws proliferate across regions. Key drivers include the EU’s GDPR, APEC’s Cross-Border Privacy Rules (CBPR) to build consumer trust as data moves between economies, and U.S. state initiatives spurred by major breaches and scandals. Vermont’s data broker legislation introduces registration, opt-out disclosure, breach notification, and legal recourse requirements, while California’s Consumer Privacy Act (effective 2020) expands consumer rights. Sector-specific mandates add complexity, such as the NY DFS Cybersecurity Regulation (23 NYCRR 500), which requires regulated financial institutions to assess cyber risk and maintain audit trails with a three-year retention expectation rather than five.

Organizations must identify where data resides, classify sensitivity and risk, and demonstrate compliance across overlapping rules. Traditional Identity Governance and Administration (IGA), originally driven by SOX separation-of-duties needs, addresses only part of the broader data compliance problem, motivating a more comprehensive approach based on data intelligence.

BigID positions its Data Intelligence Platform as that foundation by discovering, indexing, and correlating identity-related data across heterogeneous sources without centralizing the underlying sensitive content. It connects to structured and unstructured systems, uses ML/AI techniques (e.g., classification, entity extraction/resolution, clustering, confidence and re-identifiability scoring), and builds an inventory enabling centralized dashboards, risk trends, and relationship/flow visualizations (including swim lanes). BigID layers purpose-built apps for privacy (e.g., subject access automation, RoPA tracking, consent, portals, transfer monitoring), protection (e.g., access intelligence, remediation, labeling, breach investigation), and data perspectives (e.g., quality and retention, with stewardship/provenance planned). The platform supports policy-driven remediation, integrations, SSO (SAML), RBAC, DevOps via REST APIs/SDKs, and flexible deployment (on-prem, cloud, hybrid, SaaS, Kubernetes). Noted constraints include coarse-grained policy granularity, a developing partner ecosystem, VC funding status, and lack of blockchain data-source support.

• GDPR gives Europeans the right to control personal information collected by organizations.
• APEC initiated Cross-Border Privacy Rules (CBPR) to build trust as individuals’ data flows between APEC economies.
• Vermont enacted the first U.S. data broker legislation requiring registration, opt-out information, breach disclosure, and legal recourse for abuse.
• The California Consumer Privacy Act took effect in 2020.
• NY DFS Cybersecurity Regulation (23 NYCRR 500) requires regulated New York financial institutions to assess cybersecurity risk profiles.
• The NY DFS regulation includes audit trails showing a three-year data retention period rather than the previous five-year standard.
• BigID was founded in 2016 and is headquartered in New York with offices in Tel Aviv, London, Zurich, Singapore, and São Paulo.
• BigID reports 7x year-over-year growth performance.
• The platform does not store, move, or copy sensitive data; discovered values are stored as a one-way hash and temporarily cached during retrieval.
• BigID supports SSO using SAML and uses an internal role-based access control model.

• “One of the fundamental issues an organization needs to address regarding user data privacy, protection, and governance is understanding what data you have.”
• “The BigID Data Intelligence Platform gives a centralized view of their data without centralizing the data itself.”
• “Correlation of the data gives the organization the ability to map a given type of data to an identity.”
• “BigID doesn't store, move, or copy the sensitive data, but rather everything is stored in the database as a one-way hash.”
• “A comprehensive solution is needed that uses data intelligence to provide governance, privacy, and protection of customers' data.”
• “Data flow sequencing can also be accomplished by allowing the user to create swim lanes.”
• “BigID provides an open platform with an API-first perspective.”
• “Full Kubernetes (K8) deployment with auto scale and monitoring is also available.”
• “BigID started as a primarily data privacy-centric solution but has expanded to include other industry use cases such as data security and data governance through BigID Apps.”
• “Overall, BigID continues to move in a positive direction by providing clear visibility into an organization’s data.”