Safeguarding Trust: Why we need to prioritise user data security

Data breaches are not just a technological risk; they are a threat to trust. When a cultural institution fails to secure user information, it does not merely expose individuals to identity theft or fraud - it undermines the very relationship built on shared heritage and community engagement. For many, visiting an arts venue or accessing archival records is an act of cultural participation rooted in trust. That trust must be mirrored in how institutions handle digital interactions.

The unique vulnerabilities of cultural organisations

Cultural institutions often operate with limited budgets and small digital teams, making them attractive targets for cybercriminals. Unlike large corporations with dedicated security departments, many smaller heritage organisations lack the resources to implement robust cybersecurity measures. This vulnerability is compounded by the nature of the data they hold: membership details, donation histories, visitor analytics, and sometimes even sensitive personal stories submitted as part of oral history projects.

The push towards digitisation and increasingly towards use of the latest AI tool, while invaluable for accessibility and preservation, expands the attack surface. Digitised collections, virtual tours, and online exhibitions require secure infrastructure to ensure that both the content and the user data remain protected.

Beyond compliance: A moral imperative

While regulations like the UK's GDPR set clear legal standards for data protection, compliance alone is not enough. For cultural institutions, data security is a wider imperative. You serve the public good, and your audiences expect their personal information to be handled with care. A breach does not just result in fines; it can damage reputations built over decades and deter future engagement.

Consider the implications of a breach involving donor information. Beyond financial loss, it could erode confidence in the institution's ability to steward not just funds, but also the cultural legacy entrusted to it. Similarly, if a library's visitor data is compromised, it could discourage individuals from accessing vital resources, particularly marginalised communities who rely on these spaces for safe, inclusive engagement.

Practical steps towards stronger security

So, what can cultural institutions do? The path forward begins with awareness and incremental investment:

• Audit Data Practices: Understand what data is collected, why it is needed, and how long it is retained. Minimise data collection to only what is essential.

• Secure Digital Infrastructure: Ensure websites, membership portals, and cloud-based systems use encryption and multi-factor authentication. For organisations managing large volumes of digital assets, investing in secure cloud storage solutions can provide both scalability and enhanced protection.

• Train Staff and Volunteers: Human error remains a leading cause of breaches. Regular training on phishing, password hygiene, and data handling can significantly reduce risk.

• Develop a Response Plan: Even with strong defences, breaches can occur. Having a clear incident response plan ensures swift action to mitigate harm and communicate transparently with affected individuals.

Building a culture of security

Ultimately, data security should not be seen as a technical afterthought but as an integral part of an institution's mission. Just as curators protect physical artefacts, digital stewards must safeguard the information that enables engagement with your audience. By prioritising data security, you can then continue to innovate and connect with audiences while protecting the trust placed in them.

Justin Fox, Proton AG