In many countries, privacy is not limited to your company borders. In order to implement DLP in these countries, it is necessary to be cautious on many aspect otherwise you will not be able to remediate data leakage detected by your DLP solution, you may even be sued for having done this.
The “worst” case is a company with many subsidiaries around the world and which want to keep advantage of SYMANTEC DLP centralized management solution because in addition you will have to take into account these constraints for each country and data transfer between these them.
Some therefore conclude that it is not possible to implement it that way ... a little early anyway.
You can reach a compliant DLP setup in these conditions; it will however have to make some concessions and studies:
- You will have to study the legal and regulatory requirements of each country where the subsidiaries are located and how the company wants to take them into account (these constraints are not always clear or explicit, but rather subject to interpretation especially when they are only based on case laws).
- You will have to manage declaration to different authorities (especially data protection authorities)
- You will have to transpose these constraints and limitations into role definition to control who has access to what in DLP solution. In order to have an adequate segregation of duties and access you will have to add some "custom attribute" that will be usable in role definition.
- You will have to use different "policy groups" to control which policy is deploy to which detection servers or you will have to use group rules to specify populations covered by each policies.
So this will complicate setup of your centrally managed DLP solution, but it is possible to deploy DLP solution compliant with legal and regulatory constraints event in this difficult context.