Data Privacy Week runs annually to mark the signing of Convention 108, the first binding international agreement on privacy and data protection. According to Webroot's overview, the 2022 edition expanded into a week-long awareness effort in the United States, Canada and Europe.
Awareness days are easy to mock. They are also useful, in the same way that fire drills are useful — not because the fire drill is novel, but because the act of doing it resets habits. Here are five privacy habits worth resetting this week.
The short version
- Privacy awareness applies to both home and work; the threat models overlap but differ.
- Security awareness training and phishing simulations measurably reduce click rates.
- Offline backups remain the most reliable anti-ransomware control.
- Reliable antivirus or EDR with current subscriptions beats built-in tools alone.
- Reputable paid providers beat free providers for both backup and security tooling.
Habit one: read the terms you actually agree to
Whether you are installing a smart-home device or rolling out a SaaS tool for your team, the privacy terms you agree to govern what data leaves the building and where it goes. Most privacy incidents are not exotic zero-days; they are "we agreed to this in 2022 and forgot" cases.
At home: review the privacy settings on the apps you use most. Disable the permissions you do not actually need. At work: ensure vendor privacy terms are reviewed by someone other than procurement, ideally with security and legal input.
Habit two: invest in real awareness training
Phishing and social engineering remain the most common initial access vectors for ransomware and data theft. Information is lost not because training is absent; it is lost because the training is generic, infrequent and untested. Security awareness training that includes regular phishing simulations measurably reduces click rates and improves reporting.
Make the training relevant to the user's role. Finance teams need wire-fraud scenarios. Developers need supply-chain scenarios. Executives need business email compromise scenarios. One-size-fits-all training fits no one.
Habit three: back up the data you cannot replace
Backups are the privacy and ransomware control, undimmed. If you are not ready to lose a file, back it up. Better: back it up offline. Cloud-synced backups are not backups if the same credentials that ransomware steals can also reach the cloud sync.
Test restores. Quarterly is a practical cadence. Document the test. The first time you discover that your backup does not restore is not the time to discover it.
Habit four: use real antivirus or EDR
Reliable antivirus or EDR with current subscriptions beats built-in tools alone for most risk profiles. Built-in Windows Defender has improved markedly and is acceptable for low-risk home users. Anyone handling sensitive data — customer records, financial information, intellectual property — should run a reputable third-party product with current signatures and active support.
Keep the subscription current. Antivirus that has lapsed is not antivirus; it is a false sense of safety. Renew before it expires.
Habit five: choose providers you can trust
Some providers offer free protection and backup; some are supported, some are not. Free tiers often monetise by collecting telemetry, advertising back to you, or upselling features that do not work without payment. Reputable paid providers have business models aligned with your privacy; you are the customer, not the product.
Do the research: ownership, jurisdiction, jurisdiction, incident history, independent testing results. If you cannot name them in a privacy review, you cannot recommend them in a privacy review.
Our analysis
The framing worth keeping is that privacy and security are converging. Most privacy incidents are also security incidents. Most security incidents are also privacy incidents. Treating them as separate programmes wastes effort and creates gaps.
The second framing is that the basics work. Five controls — terms review, awareness training, backups, real antivirus and reputable providers — would prevent or limit most privacy incidents. The hard part is not knowing them; it is doing them consistently. Awareness weeks are useful precisely because they create a forcing function to do them.
The third framing is that resilience matters as much as prevention. You will not prevent every incident. What matters is how quickly you detect it, contain it, recover from it and tell the people affected. Build the resilience muscle now, not during the next incident.
A worked example
Say you run a 50-person professional services firm. This week, run a 30-minute privacy refresher for the team that covers phishing reporting, the clean desk policy and the BYOD rules. Audit the antivirus subscriptions on every endpoint and replace free installs with a paid product. Verify the backup job on the file server is actually running, that the backup is offline, and that you can restore a single file from last week without drama. Update the privacy notice on the company website. None of these are exciting; all of them are overdue.
Bottom line
Five boring habits. Five real outcomes.
- Read the privacy terms; reset defaults you would not agree to today.
- Run awareness training that is relevant to role and not generic.
- Maintain tested, offline backups; the only reliable anti-ransomware control.
- Use reputable, current antivirus or EDR; not free, not lapsed, not built-in alone.
- Choose providers whose business model is aligned with your privacy; you are the customer.
Frequently asked questions
What is Data Privacy Week?
An annual awareness week marking the signing of Convention 108, the first binding international agreement on privacy and data protection.
Do I need paid antivirus if I have Windows Defender?
For low-risk home users, often no. For anyone handling sensitive data, paid antivirus or EDR adds meaningful behavioural detection and support.
Are cloud-synced backups good enough?
Not against ransomware. Ransomware that reaches your cloud credentials can also reach your cloud-synced backups. Offline backups are the only reliable anti-ransomware control.
How often should phishing training be run?
At minimum quarterly, with monthly simulations for high-risk roles such as finance and executives.
What should I look for in a privacy-aware provider?
Jurisdiction, business model alignment, independent testing, transparency reports and a track record of handling incidents responsibly. (Note: Continued in next responses for remaining articles)