Now that the new GDPR rules are firmly in place, businesses will find themselves on a continuum between two camps – those that are fully GDPR compliant and those that have taken few or no steps towards compliance. For GDPR compliant companies, the opportunities and competitive advantages are clear. Not only will they avoid the hefty potential penalties inflicted for non-compliance, but they will be well on their way to building authentic, transparent relationships with customers and a more people-centric business.
At its very heart, GDPR is all about protecting customer and employee data. It requires organizations to adopt stricter data protection policies, to document how they store, use and share personal data and review data governance principles regularly to ensure compliance. The ability to manage huge volumes of data is essential to a company’s success and requires a huge culture shift to ensure data breaches are kept from the door and a solid reputation remains intact.
GDPR as an opportunity and not a threat
How an organization deals with GDPR compliance will depend on how it is utilizing data, the industry it is operating in and how and where that data is stored. The road to compliance may be expensive and complex, but the long-term opportunities that compliance creates could be plentiful when the process is managed in the right way. This involves rolling up sleeves, diving deep into data protection and changing the way that teams and individuals think about personal data.
By implementing the right compliance design principles and collecting only relevant data, companies can streamline and eliminate data storage and collection processes, prevent data breaches and cyber-attacks and significantly reduce costs. At the same time, enhancing the quality and integrity of data that flows through an organization’s internal systems can improve a company’s competitive edge and bottom line. For example, higher quality data collection enables an organization to perform sophisticated modelling and data analysis techniques and make better business decisions.
Embedding a new culture of data protection
GDPR cannot be a process that is shaped overnight. It requires buy-in from every department and every employee. It requires organizations to ensure ‘data protection by design and by default’. In other words, that data protection practices are baked into all processing activities and business practices, from design to execution. Data protection and privacy issues should be considered first which requires education and culture change. This organizational shift should begin in the boardroom and filter down through all stakeholders and members of senior management. So, what can organizations do to bring about this new data privacy culture?
Assign budget and responsibility for GDPR compliance.
Create maps of data flows internally and externally and document how personal data is used, stored and processed. Create transparent security and data protection policies that are endorsed by senior management and are simple enough for all to understand. Implement effective tools and processes that allow policies to be managed and executed and that protect the organization from the risks associated with personal data processing. Create training and awareness initiatives that educate staff about how to comply with security and data protection policies. Implement procedures and processes that address data breaches and non-compliance issues. These should document fully the organization’s responsibilities and how to report and respond to such an issue. Ensure that clear data processing records are maintained to demonstrate compliance to data protection supervisory authorities and external stakeholders.
Culture shift without the culture shock
It is essential that the entire organization is on-board with the responsible and compliant collection and treatment of personal data. This can be a challenge during the initial stages of GDPR implementation. A good place to start is for senior management to educate teams on the importance of data protection and how the law translates to each individual department. No employee will want to be responsible for a fine of up to 4 percent of global revenue. They need to understand their role in protecting data, and be aware that this is a very real risk now that GDPR is firmly in place.
A growing common practice in many organizations is the contractual change to employees’ employment contracts to reflect GDPR requirements. This not only formalizes GDPR in employee mindsets but also showcases how critical GDPR is within the organization and how seriously a staff-related data breach will be treated. While a change in contract alone will not bring about a culture shift – and could very well create a culture of fear and resentment – when coupled with education workshops, programs and incentives, contract changes could prove to be an effective step.
Building a GDPR framework is an ongoing process that begins with induction and education, and should be reinforced routinely and whenever any data protection issues occur. From creating personalized staff awareness workshops to investing in business automation and data protection solutions, there are many ways an organization can raise awareness and create a robust framework for compliance.
A simple process change just won’t cut it
GDPR legislation demands an organizational shift across all departments, from legal to sales and marketing to IT. It affects every employee, every data set and the entire customer journey. It affects technology infrastructures, internal processes and revenue. A simple process change won’t quite cut it, and while raising awareness may seem like a daunting task, a people-centric culture will strengthen GDPR readiness and your organization.
