In only two months, the European Union’s General Data Protection Regulation will go into effect. Companies around the world — in fact every company that holds any data about EU citizens —are scrambling to ensure they’re prepared to meet requirements of the regulation and avoid enormous penalties.
While avoiding financial penalties of up to 4 percent of annual turnover is clearly a strong incentive, preparing for GDPR doesn’t have to be all burden and expense. In fact, GDPR offers an unprecedented opportunity for businesses to provide better data security and privacy services to their customers.
No organization wants to be forced to adopt costly practices against their will and potentially face enormous fines if they fail to do so.
But whether the timing for stricter customer data protection is right for companies or not, GDPR and its fines are here. Companies are being forced to make these investments now, and it’s in their interest to derive as much value to their own businesses as possible from these investments. And for most, doing the bare minimum to avoid penalties will not make the best use of the time and money they’ll put into preparing for GDPR.
Fortunately, GDPR has a lot in it that customers and businesses should be happy about — requirements that will, in fact, enhance a company’s security and data protection services. These requirements include:
- Article 7: Data can only be processed in ways the subject of the data consents to.
- Article 15: Data and information about how it has been used must be accessible by the subject of the data.
- Article 17: Data must be erased upon the request of the data subject.
- Article 25: Organizations must manage information in systems built with data privacy “by design and default.”
Each of these requirements arose due to consumer concerns about how their data was being collected, stored and used. Now, every company within the scope of GDPR’s regulations has an opportunity to directly address these consumer concerns.
Customer-centric data management
GDPR’s requirements make it very clear that EU citizens have very clear rights to their personal information. They can request information about its usage, and even request its erasure.
While organizations have captured and preserved data for legitimate business purposes, GDPR pushes businesses to question the need for all of the personal data they collect, offering a prime opportunity for businesses to adopt a more customer-centric approach to data management.
What does customer-centric data management actually mean? The provisions of GDPR spell it out. Any data that is captured and stored by an organization pertaining to a specific individual must be only done for a clearly established business purpose, and a firm must respond to any inquiry from an EU citizen about how the data has been searched, processed or extracted to confirm that it was used for the purpose given when it was collected.
For example, if an organization is subject to regulatory requirements to review employee communications, and that employee is an EU citizen, it must search, review, and potentially extract the information only for the purpose of meeting that regulatory obligation. While complying with the personal data privacy protections of GDPR may seem contrary to this, establishing processes and programs that safeguard personal data show that protection of data privacy is a top priority and will become a differentiator for many firms.
The goal of GDPR is to make sure that EU citizen data is safe and within the control of those who manage or control it. Ensuring that individuals are willing to consent to their information being used for legitimate business purposes means not only complying with GDPR, but openly embracing the message that the organization will operate with complete transparency to defend what it has done with it.
Waiting until an issue arises to fully adopt GDPR compliance practices will do little to instill confidence in those who must be willing to provide information that is needed to drive your business. However, embracing the customer-centric approach, even beyond what is currently required by regulation, will bolster the trust that truly drives their willingness to share data with organizations.
To make the most of GDPR and reap the benefits of a customer-centric approach to data management, companies should:
- As part of the process of ensuring GDPR compliance, review the overall organizational approach to data management, and consider whether customer needs for control over their own data are being met.
- Take enhanced security and privacy practices beyond the confines of GDPR. After adoption, these practices can be of benefit to non-EU citizens as well, and companies should consider making them corporate policies that apply to all customers.
- Project the message that while complying with GDPR is an indicator of the importance placed on data privacy, and that the adoption of security and privacy practices is ultimately a core business value to manage privacy by design and default .
Complying with regulations like GDPR is costly, complex, and involuntary. Every organization preparing for GDPR owes it to itself and its customers to make it a forward-looking and value-generating process, rather than just a compliance burden.