SPEAKER_00 0:08

Welcome to the Technology Translator. I'm Vic. Every episode we break down technology, cybersecurity, and AI into plain English for Australian business leaders. Welcome to the podcast. Welcome back everyone! We're on to episode three. In the last episode, we spoke about the technology foundations every business should have in place when starting out in 2026. We talked about email, we talked about file storage, we talked about password managers and multi-factor authentication. Essentially, we talked about setting up the technology that allows a business to function. Today, I want to talk about something that sits underneath all of that, your data. Because if there is one mindset shift that I think every business owner needs to make, it's this. Your data is your responsibility. It's not Microsoft's, it's not Google's, it's not your IT providers, it's yours. And before we get into the technical side of things, I want to tell you about one of the most memorable conversations I have ever had. A number of years ago, I was selling penetration testing services. For those who haven't heard that term before, penetration testing is essentially where an organization pays an ethical hacker to try and find weaknesses in their systems before the bad guys do. And one day I called a reasonably large organization, a couple of hundred staff, well-known brand. I asked whether they'd ever conducted a penetration test. And the answer was immediate, no. I asked whether it was something they were considering. No. I asked whether they had concerns around protecting the systems. Again, nope. So at this point I was genuinely curious. I asked why. And the response was something I will never forget. You don't really have anything worth stealing. Now, I don't know whether he was just trying to get me off the phone or whether he genuinely believed it. But I start asking a few questions. Do you have staff? Yes. Do you process payroll? Yes. Do you store employee information? Yes. Home addresses? Yes. Bank count details? Yeah. Emergency contacts? Yep. Tax file numbers?

unknown 2:46

Yep.

SPEAKER_00 2:47

And that's when it hit me. This organization genuinely did not see this information as being valuable. Yet every single one of those pieces of information belongs to a real person, a real employee, who trusts their employer to keep that information safe. And the sad part is that conversation hasn't been unique in my experience. Over the years I've had many similar discussions with everything from recruitment companies, professional services, construction, engineering, mining, privately owned businesses, businesses that hold resumes, photographs, personal histories, family information, financial details, sometimes thousands of records worth of information. Yet many of them had never really stopped to think about what they were responsible for protecting. And that's the mindset shift I want to talk about today. Because when we talk about data, we're not talking just about files, we're talking about people, we're talking about businesses, we're talking about real things that have real impacts if actually stolen. So I mentioned the cloud in the last episode, and it's a phrase that everyone uses.

unknown 4:06

The cloud.

SPEAKER_00 4:13

Some people would say files floating around safely on the internet forever. The reality is much simpler. The cloud is just someone else's computer. Well, more accurately, it's someone else's collection of thousands of computers sitting inside highly secure data centers around the world. When you save a file onto Microsoft 365, Google Drive, Dropbox Zero, HubSpot, that information is sitting on infrastructure owned and managed by those companies. The advantage is that they maintain the servers, those big black boxes you see in movies lined up in rows with flashing lights all over them. They're just the giant computers. They maintain the power, they maintain the networking, the internet connectivity, they maintain the physical security around those facilities. Their job is to keep the infrastructure itself running. You don't need to have a server sitting in your office anymore. And honestly, that is fantastic. But here is the important bit. Just because they are storing the data does not mean that they are responsible for every possible thing that can happen to it. There is a concept in technology called the shared responsibility model. The provider is responsible for the platform, and you are responsible for what happens inside of it. Microsoft is responsible for Microsoft 365. Google is responsible for Google Workspace. HubSpot is responsible for HubSpot CRM. But you are the one who is responsible for who has access, what permissions people have, how data is stored, how information is shared, whether your staff understand how to use the tools correctly, and whether your data is backed up. And this is where organizations often get caught out. I remember working with a customer who approached us because their Microsoft costs had started increasing significantly. Every month the storage bill was climbing and no one could work out why. So we started investigating. Eventually, we discovered that one employee had copied an entire SharePoint document library into their personal OneDrive. They weren't doing anything malicious, they weren't stealing information. They simply just did not understand the difference between SharePoint and OneDrive. To them, they're just both places to share files. But by doing that, they'd effectively duplicated a huge amount of company data. And the organization was now storing everything twice. And the result was actually hundreds of dollars every month in additional storage costs. And the interesting part wasn't the money. The interesting part was that no one had ever explained the difference. And that's something you'll hear me say a lot throughout this podcast. People don't know what they don't know until someone teaches them. So why data ownership actually matters? When most people think about data, they think about documents, spreadsheets, invoices, contracts. But data ownership goes much deeper than that. Think about the information that your business holds today. It's customer details, employee records, payroll information, supplier information, emails, contracts, financials. Now, ask yourself a simple question. That information was all exposed tomorrow, who'd be impacted? Because the answer is never just the business. It's the customers, employees, suppliers, partners, real people. And that's why data protection isn't just a technology issue, it's a responsibility issue. And look, one of the most common assumptions I hear is, well, it's a Microsoft, so we'll be fine. And the answer is both yes and no. Microsoft itself, of course, has redundancy. They have disaster recovery and they have retention policies. But those systems are designed primarily to protect Microsoft service. Not every scenario your business could potentially encounter. So if files are deleted and no one notices for six months, what happens? If an employee accidentally removes critical information, what happens? If ransomware encrypts data and those changes synchronize everywhere, they're all very different questions, and that's why backups exist, or at least they should exist, because storing data and backing up data are not the same thing. And so we start looking into what actually causes cyber incidents. So when people hear the word cybersecurity, they often imagine sophisticated hackers sitting in dark rooms. The reality is much less exciting. Human error is responsible for approximately 98% of cybersecurity incidents. Think about that for a moment. 98%. We're not talking elite hackers, not foreign governments, not Hollywood style cyber criminals. They're just ordinary people making ordinary mistakes. Imagine it's 4 45 on a Friday afternoon. You've got twenty things going on, you're trying to finish the week, an invoice arrives. Looks legitimate. The supplier name looks familiar. The email appears genuine. You click. That's it. There's no malicious intempt, no stupidity, no negligence, just a busy human making decisions with incomplete information. And that's really how most cyber incidents start. And that's exactly why backups matter. And it's not because people are careless, but because people are just human. And one thing I do think businesses need to start thinking about is accountability, because governments certainly are. The Australian Privacy Act is continuing to evolve. We've got the Australian Cybersecurity Centre that's doing a lot of work in this space. Internationally, we've seen regulations like GDPR in the UK place increasing responsibility on organizations for how information is collected, stored, and protected. And I'll talk more about these topics in future episodes. But the broader trend is very, very clear. Governments are increasingly expecting organizations to take responsibility for all the information that they hold. And personally, I don't think that's unreasonable. If someone trusts you with their information, there should be an expectation that you take reasonable steps to protect it. So let's bring this all together. The cloud is fantastic. Modern technology has made running a business easier than ever. But moving to the cloud does not remove your responsibility. It just changes responsibility. Your software provider is responsible for the platform. You are responsible for your data. And if there's one thing I'd like for you to think about after today's episode, is this. What information does your business hold today and what would happen if it fell into the wrong hands? Because when you start thinking about data in terms of people rather than just the files, protecting it suddenly becomes a whole lot more important. And next episode we're going to tackle cybersecurity. Not the buzzwords, not the marketing, not the fear campaigns. Just a practical discussion about what cybersecurity actually means and where businesses should focus first. Until next time, this has been the Technology Translator. Making technology make sense. Thanks for joining the episode. If you do want to follow me on Instagram at all, you can find me under the Technology Translator. If you would like to email me, Vic at the Technology Translator.au And I guess I wouldn't be doing this properly if I didn't say, if you like what you hear, hit the follow button. There will be more of these episodes coming up.