What should your organization do on Data Privacy Day or Week?

Use Data Privacy Day, and the Data Privacy Week built around it, as a yearly review point. Minimize what you collect, check privacy and security settings, review who can access personal data, test your breach response and remind staff how to report problems. Each task is small and produces a record you can show later.

What is Data Privacy Week?

The National Cybersecurity Alliance describes Data Privacy Week as an international effort to empower individuals and businesses to respect privacy, safeguard data and enable trust. In 2026 it ran from 26 to 30 January, with the theme "Take control of your data." Its goal is twofold: help people understand that they can manage their own data, and help organizations understand why respecting users' data matters. The Alliance also argues that respecting privacy inspires trust and supports reputation and growth.

A calendar event is a useful excuse. It gives you a reason to schedule work that otherwise loses to urgent tasks.

What can an organization do in one week?

Pick tasks that fit in a day each. Here is a plan, with the reason for each.

Monday: map the data. List the systems that hold personal data, what kinds of data, and who owns each. You cannot protect what you cannot find. If a list exists, check that it is current.

Tuesday: minimize. Ask of each data field: do we need it, and for how long? The EDPB's guidance for small businesses lists data minimization among the basic GDPR principles, meaning you process only what a specific activity needs. Delete what you do not need. Data you no longer hold cannot be breached.

Wednesday: review access. For each system with personal data, list who has access and remove accounts for people who left or changed roles. Confirm administrators use multifactor authentication.

Thursday: check settings. The Alliance publishes links to privacy and security settings for popular devices and services. Check the settings on shared accounts and company devices, such as location sharing, ad personalization and app permissions. Check public cloud storage for accidental exposure.

Friday: rehearse a breach. Take a one-hour tabletop: a vendor emails to say a file with customer details was exposed. Who decides what to do? Who contacts legal? Who tells customers? Where is the breach notification procedure? Fix what the discussion exposes.

What should individuals do?

The Alliance's message to individuals is that you cannot control every piece of data about you, but a few repeatable behaviors help: review privacy settings, think about who receives your data before sharing it, and be selective about apps and services. For work, add the CISA basics: use multifactor authentication, be careful with unsolicited requests for information, and verify unusual requests through a channel you already know.

CISA's phishing guidance says not to reveal personal or financial information in email, and to check a website's security before sending sensitive information. These habits matter on any day of the year.

How does this connect to compliance?

Privacy laws vary, and this post cannot say what applies to you. As one example, the GDPR requires an appropriate legal basis, security measures and data minimization for personal data, and has specific rules for transfers outside the EEA. The week is not a substitute for a compliance program, but it is a good checkpoint: if your annual review always happens in January, you will know when it is overdue.

Constructed example. A 40-person software company runs the five tasks above. On Monday it finds a legacy spreadsheet of customer contacts on a shared drive that nobody owns. On Tuesday it deletes the spreadsheet after confirming the data lives in the CRM. On Wednesday it removes three former contractors' accounts. Nothing dramatic, but the company has fewer places where data can leak and a short written record of what it checked.

How to check or apply this

1. Schedule the review for the same week each year and name an owner.
2. Update the list of systems holding personal data and their owners.
3. Delete data you no longer need and set retention periods for the rest.
4. Review access lists, remove stale accounts and confirm MFA for administrators.
5. Check privacy and security settings on shared accounts, devices and cloud storage.
6. Run a one-hour breach tabletop and update the procedure.
7. Send staff a short reminder on how to report a suspected incident.

Quick check

Sources

• National Cybersecurity Alliance, Data Privacy Week
• EDPB, SME guide: International data transfers
• CISA, Avoiding Social Engineering and Phishing Attacks

Last reviewed: 18 October 2026.