Last year, May 25 was hanging above us like the Sword of Damocles. Coffee breaks were filled with questions such as “how can we make sure we do this right?” — and strange expressions such as “privacy-by-design,” “culture-of-compliance,” or “the right-to-be-forgotten” were flying around meeting rooms.

In the year that has followed, those phrases have become a natural part of our business vocabulary. Besides a new lingo, however, GDPR has taught us a few important lessons about data privacy principles, which can help us do better every day.

We collected five learning points that can help you keep your compliance strategy effective.
 

1. Don’t overlook the human factor

As data privacy regulations are constantly evolving — and your business is changing — it is fair to say that maintaining compliance is an ongoing process. In today’s volatile business environment, if you want to help ensure that compliance measures remain solid, even against rigorous regulatory audits, you cannot allow cracks to appear.

Having the most carefully engineered processes and best tools in place are often not enough. Investing in your staff and building a “culture of compliance,” however, can make a useful contribution to a successful compliance strategy. Investing in your employees and corporate culture doesn’t necessarily have to be costly. Proper employee training, automating certain processes to minimize variability, and rewards for staff advocating better data governance can all play a part.
 

2. Compliance is not a one-person show

Accountability is an element of several data privacy measures, affecting all areas of the business. Compliance is not just an issue for Legal or IT, or the sole responsibility of the Data Protection Officer (DPO). Data protection should be taken seriously by all departments –from Finance, through HR to Sales and Marketing. Therefore, strong collaboration between functions is essential.

Breaking down these silos can help you in several ways:

• It can unite the different skills and knowledge required for implementing an efficient compliance structure — helping to ensure HR and Legal are up-to-date with the latest data governance rules, and that IT has the proficiency to provide the technological backbone needed for adherence.
• It can ease resource and budget constraints, which can be significant factors hindering your compliance aspirations. A joint effort of business stakeholders can ease these burdens by allocating costs and headcount more evenly. 

3. Data consolidation is essential

The scope of information that needs to be captured and the extent of data generated every day have been growing exponentially in recent years. This trend can cause a serious headache for IT and compliance teams, since this tsunami of data often comes from disparate systems and is stored in different databases in different formats. This issue is multiplied when a business operates in different geographical regions or grows through acquisitions. 

This, in turn, makes securing, managing and retrieving data scattered across the IT environment a major challenge whenever:

• the organization needs to respond to regulatory requests in a timely manner, or
• a customer changes their privacy choices and their data needs to be identified, or
• personal data must be replaced, deleted, or anonymized at the end of its lifecycle.

When data is stored in a single repository, these tasks can become easier and more reliable to complete. However, if consolidating data is not possible or practical, automatic and reliable tagging can still ease the task of bringing together an individual’s data from various sources.
 

4. Data security is more important than ever

Cybersecurity threats need to be taken very seriously. Organizations found to have inadequate controls in place to restrict access to the personal data they hold and manage are unlikely to be looked upon sympathetically by regulators. Access to personal information must be controlled and restricted to those with a legitimate requirement — at all times.

In addition, and just as crucially, while it may not always be possible to prevent a data breach, it is possible to make any leaked data unusable by the hackers. Properly designed encryption capabilities can keep data secure whether in transit or at rest. In so doing, the hacked information remains unreadable and, therefore, secure. 

This practice is even more important today, when some data privacy measures demand that data collection be restricted by specific opt-in rules, increasing the value of properly collected personal data.
 

5. Privacy is a competitive differentiator

Although compliance with these regulations can often lead to stress and frustration, agile and forward-looking companies are taking their strategy a step beyond, viewing today’s regulations as another component of their holistic customer engagement strategy. 

Cultivating customer trust, securing data via encryption and access-control, taking privacy into account in all processes, and building a culture of accountability can not only help minimize the risk of financial and reputational damage caused by regulatory breaches, but it can also be a source of competitive advantage. 

The bottom line?

Along with carefully chosen tools and processes, bearing the most common data protection principles of data privacy measures in mind can help you keep your business afloat even in a rising tide of regulations.

With twenty-five years of experience working with customer data, Verint is offering solutions that can help you:

• Facilitate your plans for compliance with various regulations.
• Create consistency and eliminate errors by automating repetitive steps.
• Capture, analyze, store and retrieve interaction data across multiple channels, systems and databases.
• Turn data into actionable business insights, helping you make data-driven decisions faster, create more accurate forecasts, and manage scheduling in a more agile way.