Most companies do not lose data to a hooded hacker. They lose it to a leaver who kept their logins for three months, a sales spreadsheet emailed to the wrong "David", a vendor still holding a customer export from a project that ended two years ago, or an intern granted admin access "just to get them started". None of that shows up in a firewall report. All of it is your problem as COO.

Digital security has two halves. One is keeping attackers out: firewalls, endpoint protection, patching, phishing defence. That is the cybersecurity handbook side, largely the CISO or IT lead's craft. The other half is the one operations owns: who can touch which data, why, how long it lives, where copies sit, and what happens when something goes wrong. This guide is about that second half: the part that fails quietly, and the part a COO controls.

Here is the payoff. If you can answer four questions with confidence, you are ahead of most organisations your size: What is our most sensitive data and where does it live? Who can access it and should they? How fast would we know if it leaked? Who does what in the first hour of a breach? The rest of this article turns those four questions into a working programme.

Know what you are protecting: data classification

You cannot protect data you have not named. Classification means sorting information into a few clear tiers so everyone treats a customer's bank details differently from a blog draft. Most firms need only three or four: Public (marketing copy, published prices), Internal (org charts, meeting notes), Confidential (contracts, salaries, roadmaps), and Restricted (customer financial data, health records, credentials).

STRONG looks like this: every system and shared drive maps to a tier, new document templates default to the right label, and staff can tell you in one sentence why a file is Confidential. WEAK looks like a 40-page policy nobody has read, where the same customer list is "Restricted" in the CRM and an unlabelled spreadsheet in someone's personal cloud folder.

Start from the data, not the policy. Pick your three highest-value data types (usually customer records, payment data, and employee data) and trace where each is created, stored, copied, and shared. You will almost always find copies you did not know about: an analyst's local export, a backup in an old vendor's system, a "temporary" sheet from 2023. Naming the tiers is easy; the value is in the map of where each tier actually lives.

Access control and least privilege

Least privilege means each person and system gets exactly the access needed to do the job, and nothing more. It is the single highest-leverage control a COO can push, because over-broad access turns every small incident into a large one. If a phished account can only see its own team's files, the blast radius is small. If it can see everything, one careless click becomes a company-wide breach.

STRONG: access is granted by role, reviewed on a schedule, revoked automatically the day someone leaves or changes teams, and admin rights are rare and logged. WEAK: access is granted ad hoc by whoever asks, nobody remembers to remove it, and half the company has admin because taking it away "might break something". A quick test: pull the list of everyone with admin or all-data access to your CRM or finance system and ask, for each name, "why?" The names you cannot justify are your risk.

Two mechanics carry most of the weight. First, mandatory multi-factor authentication on every account, not just admins, because stolen passwords are the most common way in. Second, an offboarding checklist tied to your leaver process so access dies the same day employment does. Wire security into your operational workflows as part of how you handle operational risk generally. A control that depends on someone remembering has already failed.

Data retention: the safest data is the data you deleted

Every record you keep is a record you must protect, and one more thing an attacker can steal. Retention is the discipline of deleting data on a schedule once it has served its purpose. It is unglamorous and it quietly shrinks your entire risk surface. The vendor export nobody deleted, the years of old support tickets, the departed customers' payment records kept "just in case": each is a liability earning nothing.

STRONG retention means defined periods per data type ("delete inactive customer records after X years, delete server logs after 90 days"), enforced automatically rather than by hand, with legal and finance holds handled as explicit exceptions. WEAK means keeping everything forever because deletion feels risky and nobody owns the decision.

For your top three data types, agree a retention period with legal and the data owner, then automate the deletion. A mid-sized firm that deletes inactive-customer data on a two-year clock is a far smaller target than an identical firm holding a decade of it, and it finds compliance easier too, because most privacy laws expect you to keep personal data no longer than needed.

Privacy and regulatory obligations

Privacy law turns good data hygiene from optional into mandatory, and the penalties are real enough that this belongs on the COO's desk, not buried in legal. The specifics vary by regime and region, so treat the frameworks below as real and well established but verify the exact obligations for your jurisdiction and sector before you rely on them:

• GDPR (EU/UK personal data): consent, data-subject access and deletion requests, and breach-notification duties.
• CCPA/CPRA (California consumer data): disclosure and opt-out rights for residents.
• HIPAA (US health information): safeguards for protected health data.
• PCI DSS (payment card data): a security standard, not a law, but contractually binding if you take cards.

You do not need to be the lawyer. You need to know which regimes apply and to have a named owner for each, so a data-subject request or a breach-notification clock does not catch the company flat-footed. Fold these into your wider compliance management programme and regulatory compliance tracking. STRONG means you can produce, on request, what personal data you hold on one named individual and delete it within the legal window. WEAK means that request triggers a two-week scramble across a dozen systems.

Third-party and vendor data risk

Your data does not stay inside your walls. It sits in your CRM vendor's cloud, your payroll processor, your analytics tools, and every SaaS app someone signed up for on a company card. Each is a place your data can leak, and their breach becomes your breach in the eyes of customers and regulators. Vendor risk is often the biggest gap in an otherwise tidy programme, because it sits outside your own systems.

STRONG vendor management means a live inventory of who holds your data, a real security check before onboarding (a proper questionnaire, evidence of certifications like ISO 27001 or SOC 2, contractual breach-notification terms), and offboarding that confirms a vendor has deleted your data when a contract ends. WEAK means nobody has a full list, the review was a procurement checkbox, and ex-vendors quietly retain years of exports. Build this into your standard vendor management process so security is assessed at contract time, while you still have negotiating room, not after the data has already left.

Incident response: the first hour decides the damage

You will have an incident. The question is whether the first hour is orderly or chaotic. An incident response plan is a short, rehearsed playbook that says who does what when data may have been exposed. The plans that work are one page and practised; the plans that fail are 30 pages in a folder no one opens.

The core moves are: detect (someone notices and knows where to report it), contain (cut off the affected account or system before it spreads), assess (what data, how much, whose), notify (customers, regulators, and leadership on the required clock), and recover and review (restore, then run an honest post-incident review so the gap does not reopen). Assign a named incident lead and a decision-maker in advance, because a breach at 11pm is the wrong time to work out who can authorise taking a production system offline.

Two metrics tell you whether this is real: mean time to detect and mean time to respond. If your honest answer to "how would we know?" is "a customer or a journalist would tell us", detection is your first investment. Tie recovery to your business continuity plan: backups you have actually tested restoring from, plus a communication plan for staff and customers, turn a bad day into a recoverable one. Run a tabletop exercise once or twice a year so the first real incident is not the first time anyone reads the plan.

Key takeaways

• Most data loss comes from ordinary operational failures, orphaned access, careless sharing, forgotten vendor copies, not sophisticated attacks. That is exactly why it belongs to the COO.
• Classify your data into three or four tiers and map where each tier actually lives. The copies you did not know existed are your real exposure.
• Least privilege plus mandatory multi-factor authentication plus same-day offboarding closes the biggest, cheapest gaps. Access nobody can justify is risk.
• Deleting data on a retention schedule shrinks your risk surface for free. The safest record is the one you no longer hold.
• Vendors are your data's back door. Keep a live inventory, assess security at contract time, and confirm deletion at offboarding.
• Have a one-page, rehearsed incident response plan with a named lead. The first hour decides how bad it gets.

Frequently asked questions

What is the difference between the COO's security role and the IT or CISO role? IT and the CISO own the technical defences: firewalls, threat detection, patching, network security. The COO owns the operational side that makes those defences hold: who has access and why, how data flows through the business, retention and offboarding, vendor oversight, and incident coordination. The two roles are partners, and the technology fails when the discipline around it is weak. Where should a COO start with no real data security programme in place? Start with two things. First, an access review: pull the list of everyone with wide-ranging access to your most sensitive systems and remove anything nobody can justify. Second, a one-page incident response plan naming who does what if data leaks. Both are low-cost and high-impact, and neither needs new tooling. Classification and retention come next, once you know what you hold. How much should we spend on data security? Spend follows risk, not fear. Do a simple risk assessment first: identify your most sensitive data, the likeliest ways it could leak, and the impact if it did. Then fund the controls that reduce your biggest exposures. Multi-factor authentication, offboarding automation, and vendor review are usually cheap relative to their impact. Avoid buying tools before you understand your risks; a well-run process beats an expensive product nobody has configured. What is the single most common data security gap in mid-sized companies? Access that outlives its purpose. People change roles or leave and keep permissions they no longer need, so access quietly accumulates until a large share of staff can reach data they have no reason to touch. Same-day offboarding tied to your leaver process, plus a quarterly access review, fixes most of it, and both are process changes rather than purchases.