We know that data privacy is a complex business.
Even the most seasoned Privacy experts agree that staying abreast of ever-changing privacy laws, such as updates to the European Union (EU) General Data Protection Regulation (GDPR) or California The Consumer Privacy Act (CCPA).
So it’s no surprise that compliance with the latest regulations has been named the number one privacy risk by stakeholders TrustArc’s 2022 Global Privacy Benchmark Study.
Compliance trumps data privacy risk
In fact, four of the top nine data privacy risks cited by respondents to our 2022 Benchmark Survey are related to compliance in some way:
-
- Compliance with the latest regulations that came into force or will be introduced in 2022 (37%)
- Implementation of new cross-border data transfer mechanisms in different regions (22%)
- Maintaining a number of individual local privacy requirements (11%)
- Compliance risks due to regulatory scrutiny and fines (10%)
- Reputational risks in social networks (6%)
- Third Party Risk and Resilience in Your Supply Chain Management (5%)
- Technological changes (e.g. third-party cookies, Google changes to cookie collection) (4%)
- Insider threats from employees (4%)
- Maintaining a range of privacy solutions that are difficult to integrate with each other (3%).
(Note: The results show the percentage of respondents who ranked risk as the number one privacy risk they face.)
But privacy management is more than just complying with data laws
Privacy-conscious organizations know this is no easy feat. This requires constant and vigilant data security in almost all parts of the business.
Arguably, the term “privacy compliance” is an understatement.
While governments continue to update existing data privacy laws and develop new regulations, compliance with data privacy laws is a key priority. However, the challenges and opportunities associated with managing sensitive data go far beyond compliance management.
Here’s why:
The pandemic has accelerated digital transformation – and data privacy risks
Certainly, the pandemic has made managing data privacy even more difficult.
Most organizations have been forced to rely heavily on third-party technology to keep employees connected and collaborating on day-to-day operations.
This immediately raised concerns about managing vendor and other third-party risks as employees and business partners moved to online ways of working, often using connections for personal data and devices outside the organization’s direct control.
Similarly, organizations that accelerated their digital transformation plans to serve customers primarily online (especially at a time when access to physical premises was limited) needed to upgrade not only their safeguards when handling more data, but also their policies and day-to-day processes.
Now that more people have returned to work for their employers, companies must address additional data privacy issues related to managing the risks of COVID-19, such as recording and reporting employee body temperatures or test results.
Digital transformation means privacy management is more expensive
As more organizations use new digital tools to improve their operations and competitiveness, we see privacy management moving up the list of budget priorities.
Historically, securing the budget for more leadership, resources, and activities related to privacy governance has been a mammoth task.
Back in 2020, when TrustArc conducted its first annual global privacy benchmark study, we found that Although the pandemic has reduced privacy spending, more than two-fifths (41%) of respondents expected to maintain increased privacy budgets.
Now we’re seeing even more organizations invest in the people, technology and third-party guidance they recognize as necessary to improve their privacy programs.
It’s great that companies are not only driven by fear of privacy regulators, but that they see the benefits of treating privacy as a core value rather than an afterthought.
TrustArc’s seven keys to strengthening your data privacy position
Each year, when we conduct our annual Global Privacy Benchmarking Study, we report that measurement is an important factor in successfully improving privacy.
However, we also found that while mid-sized and large enterprises typically have privacy offices and measurement practices, there is wide variation in where these privacy groups fit within their organizations.
We also found that there is still no consensus on the best ways to manage and measure privacy.
We recommend that privacy becomes a core part of business strategy, with a strong privacy position directed from the top and well managed at all levels of the organization.
In our experience, companies that get it right build greater trust inside and outside their organizations and gain greater competitive advantage.
Seven keys:
-
- Privacy is an important consideration in everyday business decisions
- The Board of Directors regularly reviews and discusses privacy issues
- Keeping privacy a core part of business strategy
- Adopting privacy practices as a key differentiator
- Keeping privacy in mind as a business
- Ensure that every employee can formally raise a privacy issue with confidence that there will be no retaliation
- Adequate training of employees on privacy issues.
Three important reasons to keep data private
1. Build consumer confidence
In 2020, TrustArc invited our customers (via the third-party customer validation tool TechValidate) to share their thoughts on why a strong privacy program is important to their company.
The general sentiment among TrustArc customers is that having a strong privacy program means their enterprise customers can trust their data practices without fear of breach or misuse.
This sentiment shows that many organizations are truly putting consumers first when investing in privacy programs to improve their digital offerings. It’s not about checking a box to meet requirements: it’s about building a deep trust between consumers and a company.
These companies know that consumers are now much more aware of data privacy risks and concerned about how their personal data is used, so the reputational damage from breaching data privacy laws can be just as crippling as a regulatory fine.
In a TechValidate survey, a data protection specialist at a mid-sized consumer products company that works with TrustArc said that,
“A strong privacy program goes beyond regulation and is built on a culture of data ethics. It’s part of building and maintaining customer and employee trust.”
2. Privacy is now a major competitive factor
As data privacy matters to more people, organizations need to take a stronger stance on privacy in all digital and data-related areas of their business.
We believe that privacy can be a source of innovation, not an innovation killer. Your organization can make your privacy position a key competitive factor if:
-
- Adopting a strong culture of proper data privacy ethics; and
- Privacy is built into every product and service.
A great example of how a company publicized its privacy stance to gain consumer trust came in 2019, when Apple promoted privacy as a key message in its iPhone marketing campaigns.
At the beginning of that year Apple announced its intentions at CES (Exhibition of consumer electronics) in Las Vegas with a neat twist on the infamous Sin City catchphrase: “What happens on your iPhone stays on your iPhone.”
Later in 2019 Apple expanded its privacy message in a well-produced video highlighting all the ways we expect privacy in our daily lives (tinted windows, locks, document shredders, etc.) and confidently stated:
“If privacy matters in your life, it should matter to the phone you use. Privacy. It’s an iPhone.”
Apple’s promotion of its privacy position was a clear recognition that privacy strongly influences a consumer’s purchase decision and that Apple wanted to prove that it was better than its competitors at providing consumers with the privacy they wanted.
Privacy is not a fad
People’s expectations that organizations properly manage and protect the privacy of their data will not diminish just because more of their lives depend on digital technology. Privacy is not a fad that will go out of style.
Consumers are increasingly aware of data privacy laws and demand that organizations respect their privacy or pay the consequences.
This means that all organizations must stay abreast of changes in data privacy laws around the world and demonstrate that they are meeting people’s demands and privacy rights if they are to maximize consumer trust and minimize risk.
Data privacy is complicated. Learn how to assess the credibility of a privacy provider
Find out how your organization’s privacy efforts compare to peers around the world, read the latest Global Privacy Benchmarks Report.
We know that maintaining data privacy can be difficult, but we believe we can make it easier for your organization to manage.
