Crafting a Modern Data Compliance Function

When lawmakers in the United Kingdom adopted the General Data Protection Regulation (GDPR) in 2018, the global privacy and compliance landscape experienced a monumental shift. At that time, most organizations around the world enacted changes to bolster their own privacy practices and ensure compliance with what was considered the new gold standard for privacy regulations.

Yet, despite the ongoing success of GDPR, the regulation is not a one-size-fits-all compliance solution. In order to thrive in a data-driven world, it’s essential for global businesses to adopt modern data compliance and privacy strategies tailored to their specific needs.

What Constitutes a Modern Data Compliance Strategy?

A data compliance strategy reduces the inherent risks of data collection and helps ensure that the rules defined by external authorities are followed correctly. A comprehensive strategy ensures that companies choosing to use data for business practices are respecting the privacy rights of individuals.

How to Navigate Global Data Compliance

When it comes to crafting their data compliance strategy, international companies of all sizes and across all industries ask the same question: Should our business create a single global compliance model, or individual ones for each region where our business operates? The answer is: It depends.

The key to navigating global compliance is to be realistic and to align internal stakeholders on expectations. Every data compliance strategy is going to look a bit different and be unique to the particular business. The good news is that your business is likely to have all of the information it needs to start today. We recommend starting small and straight away, and then iterating over time. 

To successfully craft your modern data compliance strategy, there are three things to consider: 

Understand the Needs of Your Business 

When go-to-market teams develop a compliance strategy, they often focus too much on one specific regulation — and in doing so, can miss the bigger picture. Rather than using an existing law as a starting point, it’s important to understand your organization’s business model. 

Your business model includes all of the products or services being sold, internal operations, revenue sources, customer base, and more. It’s also important to define your commercial needs, such as where and how you engage with new and existing customers, how each department supports the buyer’s experience, what information is being tracked on these customers, and ultimately, what’s done with their information. Consider local employment law alongside privacy rules, and don’t forget your employees’ data, where you may also have stakeholders such as trade unions or European Works Councils.

All of these considerations will help determine the type of compliance structure that makes the most sense to implement. You may decide that a single compliance strategy checks all of the necessary boxes for each region. However, if your business is planning to expand into a stricter region, such as Europe,  understanding how privacy laws vary country by country might lead you to implement a multi-faceted compliance strategy. 

Determine Your Internal Business Data Processes

How businesses collect and process data is often the core area of scrutiny for privacy and compliance regulations. It’s important to learn how these processes work at your company. 

You should ask your internal data team about your information lifecycles:

• Where do we source our data? 
• How is this data used to support our internal processes?
• Who do we share data with?
• How do we dispose of data when we no longer need it?

For example, a compliance professional working for a credit card company should learn how the business acquires new clients, how the data for those clients is being collected, and ultimately how the business generates revenue with the data. 

Understanding these data details thoroughly will save your team from headaches down the road. By the time you evaluate privacy regulations in each country you serve, your teams will know the basic principles that will create your compliance baseline.

Acknowledge What is Going on Around the World

Even if you have a dedicated compliance team, keeping up with constantly changing regulations can seem daunting. In the same way that every compliance strategy is going to look a bit different, the resources that businesses invest will vary greatly.

For teams just beginning work on their data compliance strategy, there are abundant free resources available to monitor the ever-evolving privacy and compliance landscape. As your compliance strategy grows, you may choose to make additional investments, such as technology solutions and industry memberships, to continue bolstering your privacy compliance efforts.

Key Takeaways

Privacy compliance, like everything else in business, must work collaboratively. As you continue defining your data privacy compliance strategy, remember that the landscape is constantly evolving and that any approach you take must be iterative. There are three aspects to consider when it comes to creating a compliance model:

1. Regulations: Privacy laws are changing all the time. Even as you create an internal North Star to guide your efforts, make sure to establish a feedback loop that captures any new local laws or regulations where your business operates.
2. Societal Expectations: Society’s perspective on what is and is not OK to do with data is changing all the time. As we’re seeing with new restrictions on things like third-party cookies, what may have worked yesterday — or even today — may not be acceptable tomorrow. 
3. Innovations: Technology is constantly changing. There will be new ways to collect and process data that emerge over time, and while compliance technology solutions still have some ways to go, more and more vendors are surfacing to support global businesses.

When it comes to building a global data compliance strategy, remember that it’s better to enact a strategy now, even if it’s more high-level, than to spend two years trying to make your model perfect. By that time, you run the risk that all of the laws will be out-of-date. Get going!