Shortcuts Won’t Save Anyone From GDPR

Companies must be transparent about the benefits that individuals will receive. They must focus on how they can work most effectively within GDPR, because it is inevitable. Myriad other proposed privacy regulations will certainly come to pass.

Here’s what needs to happen.

Embrace a culture of ‘privacy first’

GDPR underscores the differences in privacy culture between Europe and the US. In Europe, privacy has for decades been a fundamental right, driven by citizens and enforced by the government. By contrast, privacy in the US is a newer concept that’s primarily driven by government, while citizens remain largely uninvolved.

However, this is starting to change. A recent outcry over the misuse of data by companies such as Facebook has shed light on years of questionable marketing practices, and people are demanding reform. California’s recently introduced Consumer Privacy Act is a small yet symbolic step.

But to make real progress, individual companies must take responsibility and examine their own internal cultures. Privacy must be given a seat at the table, and companies must have the desire to innovate.

Those that resist or simply fail to evolve will pay the price in consumer mindshare, government sanctions or both.

Build a framework for every user

Once the thinking is where it needs to be, companies must create a consolidated set of requirements, and not just to comply with GDPR. Companies must apply equal privacy standards across any country where they have a regulatory obligation. They should not, however, just give everyone a copy of every law and expect them to understand and comply.

Companies need to give their employees a single list of requirements and clear instructions for how to meet them. To do that, companies must first know their true current states.

They should start by documenting their current controls — business, process and technical. Those controls should be mapped to requirements. The control gaps must be assessed openly and honestly, with the associated business risks documented with each gap. Inevitable unmitigated risks must be communicated and used to prioritize investments of both time and money.

Current and future business initiatives, data use and other activities can quickly and easily be assessed against the existing set of controls and gaps. Some activities make compliance easier, while some make it more difficult; however, the change in risk and controls will now be known and the costs and benefits made clear.

Compliance is complex and getting more difficult every day. Those who fail to innovate and adapt by taking on the challenge now will undoubtedly fail and expend more effort later. Leading in privacy can and will allow companies to move faster and more confidently with new products, markets and opportunities.

Follow Amperity (@amperity) and AdExchanger (@adexchanger) on Twitter.

This post was syndicated from Ad Exchanger.