Building a Comprehensive Data Privacy Programme: Four Actionable Steps for Technology Companies

Several countries including Brazil, Canada and South Africa have implemented comprehensive privacy regulations. In recent years, these efforts have been driven by the need to create stricter data privacy rules around new technological and market developments. Within the European Union, for example, Parliament is finalising new rules governing the processing of information by electronic communications service providers. After more than four years of difficult negotiations, the European Council announced in February 2021 that member states have reached an agreement on the new ePrivacy regulations to replace the 20-year-old ePrivacy Directive.^[3]

The ePrivacy regulations will cover electronic communications content transmitted using publicly available services and networks, and metadata related to the communication, as well as machine-to-machine data transmitted via a public network. In a statement, Pedro Nuno Santos, the president of the European Council, admitted the path to reaching an agreement has not been easy, but "we now have a mandate that strikes a good balance between solid protection of the private life of individuals and fostering the development of new technologies and innovation."

Among these technologies, artificial intelligence is a growing area of focus. In March 2021, the Centre for Information Policy Leadership, a global data privacy and cybersecurity think tank, issued a white paper on how to implement a risk-based approach to AI regulation and compliance. With the intention of informing current EU discussions on the topic, the organisation recommended, among other things, a regulatory framework focusing only on high-risk AI applications and a risk-based organisational accountability framework that calibrates AI requirements and compliance to the specific risks at hand.^[4]

Changes in the regulatory environment aside, there are other reasons technology companies should prioritise building a comprehensive data privacy programme. Consumer sentiment is one. Recent data shows that 64% of consumers in the United States consider a company’s data privacy policies very important.^[9] In a recent survey of more than 1,000 North American consumers, over half of the respondents said they are likelier to trust a company that asks only for information relevant to its products or that limits the amount of personal information requested — a signal, perhaps, that these consumers perceive the company as taking a thoughtful approach to data management.^[10]

In the post pandemic recovery period, technology companies will want to ensure that they are well-positioned to use customer data for innovation and deliver new products and services. Transparent and easy-to-understand policies and practices for data privacy and protection will help businesses earn users’ trust along with their willingness to permit the company to collect and use their data to create new and more personalised customer experiences.

Also, as the responsible investment trend continues to expand, a growing number of investors are giving a more critical eye to how technology companies protect their customers’ personal data. Current trends suggest data privacy practices are becoming more important to environmental, social and governance 
(ESG) reporting. As an example, S&P Global has added several cybersecurity data and privacy questions to its Corporate Sustainability Assessment which it issues to companies.^[11] Some leading tech companies are already detailing data privacy policies and practices in their corporate social responsibility reports and other public-facing outlets, including their websites.

Positive change comes from treating data privacy and protection efforts like a formal compliance initiative. That will help to ensure that the business, at all levels, starts to look at everything it does through a privacy lens. How does every new partnership, marketing strategy, product or service rollout, or other change potentially impact data privacy and protection commitments that the company has made, or the compliance mandates it needs to meet?

It takes time, focus and resources to transition to this way of thinking and make data privacy and protection an embedded process. Based on Protiviti’s experience working with leading technology companies, the following four steps are fundamental to laying the groundwork for a comprehensive data privacy programme that can help the business preserve customer confidence and meet evolving and intensifying regulatory expectations:

01: Conduct a data privacy risk assessment

This assessment is essential for identifying weaknesses in data privacy compliance and protection efforts. The objective of a typical risk assessment is to identify:

• The data collected, stored and processed by the organisation
• The privacy risks to that data (e.g., confidentiality, security)
• Controls in place at the organisation to address those risks
• Residual risks not addressed by those controls (i.e., the gaps)

Ultimately, the assessment can help leadership better understand which data privacy and protection regulations are most critical to the business and determine compliance obligations.

02: Establish a baseline

Baselining involves capturing the totality of an organisation’s privacy commitments; determining exactly what the company has promised its customers regarding how the business collects, processes, stores and transfers their data; and, most important, whether or not the company is honoring those commitments. In the absence of a federal privacy law and the prevalence of disparate state laws, it is critical that organisations adopt a baseline to control the framework they are building. Organisations should consider extending these commitments to contracts, third-party vendor relationships and training.

03: Manage change

Organisations must continually assess how new privacy decisions, changes to services and products, or changes to how consumer data shared with third parties can impact data privacy commitments and compliance requirements. Traditionally this has been a major challenge for organisations, particularly large technology companies, where changes happen at a code or data level literally every minute. Building a sustainable change-management programme that can manage this change is critical. For leaders, this means ensuring that data privacy is a strategic priority for the business and that a “culture of compliance” around data privacy is established. Effectively managing change ensures that privacy commitments to customers are honored and trust is maintained.

04: Documentation

There are two critical documentation approaches that are essential to building a successful data privacy programme. First, it’s important to document the privacy procedures, processes, risks and/or controls. This is a deficiency for many technology companies because it takes time, effort and investment to do it in a comprehensive way. Second, the processes within the business that deal with customer information (or covered information) also require documentation because they generate the risks that firms need to understand and carefully manage. Having a proper understanding of the existing processes requires capturing how changes to those processes would impact privacy risk. Inevitably, organisations that do not maintain clearly verifiable and readily accessible documentation of plans and processes tend to encounter challenges managing their programme. As such, an employee dedicated to managing document security and compliance, as well as ensuring that all records are complete and updated, is highly recommended.