The increasingly complex regulatory landscape means businesses have to confront the challenges of adhering to compliance
Mark Roebuck, DPO and Founder of ProvePrivacy explains how companies struggling to keep up with data regulation adherence demands should look to internal Data Champions.
For companies of all sizes, across all sectors, the prospect of keeping up-to-date and adhering to an increasingly complex data regulatory landscape is a daunting one. For those organisations in highly regulated sectors, such as the public sector, education and legal, the pressure to adhere and to ensure that staff understand the nature of compliance and their role in it means it can appear to be an almost impossible task.
As a result, organisations are sticking their heads in the sand and ignoring the issue. The problem is it will not get any better and in fact is likely to get more complex.
The varying cost of adherence
Companies are struggling to work out how they can afford to put into place the processes needed to ensure adherence. This cost comes in a variety of forms. Budgetary restraints impact not just smaller firms but enterprise level too. The implementation of new technology or the management of legacy systems that are needed to conform to regulation can be a costly, but necessary step.
Equally ‘time’ can be a cost that most companies are struggling to come to terms with. This can particularly be the case with SMEs which lack the internal resources to ensure adherence. However, this can also be the case for public sector organisations who often struggle with reduced budgets and the ability to attract the necessary staff.
Remembering why regulations are implemented in the first place
These logistical and financial costs make this seem too big a task for most companies to even contemplate. Even for those attempting to adhere, the temptation to treat the road to compliance as a tick-box exercise is understandable. However, it is important to remember why regulations are introduced in the first place.
Regulations are designed and introduced to confront a particular need or threat that is impacting companies and customers. Therefore, regarding them purely as a tick-box exercise to secure adherence means that companies are missing the point and putting data and customers at risk.
The tick-box route also means that once adherence is secured it tends to be forgotten about, thought of as a completed task, allowing the IT team and the company as a whole can take their ‘foot off the gas’. In reality, regulation has to be an ongoing process.
Current methods mean it is hard for companies to ‘Excel’ at adherence
Alongside the ongoing process of data regulation adherence companies are also struggling with their current regulation solutions. Many are still utilising Excel forms, which whilst recording information cannot be regarded as an effective method of ensuring ongoing adherence nor ensuring data security. Equally, whilst Excel can be used as a risk register, it does not allow companies to identify and subsequently manage risk as part of the same solution, which stifles the adoption of Excel as a holistic solution.
We have seen that the result of a data breach can be disastrous and the number of organisations being impacted is rising. A Government report highlighted that half of businesses (50 percent) and around a third of charities (32 percent) reported having experienced some form of cyber security breach or attack in the last twelve months. This rises to much higher levels for medium-sized businesses (70 percent) and even higher for large companies (74 percent).
So, with more organisations than ever being impacted by data breaches so the cost of a breach also increases. Research has found the average cost of a data breach in the UK averaged at an incredible £3.4 million. Add to this more research, this time from security company Egress which shows that four-in-ten employees have been sacked as a result of email security breaches it is clear that the consequence of a data breach has never been more costly, for customers, organisations or employees.
The cost of a breach means that Excel and similar programs are no longer effective ways of monitoring security and adherence to regulations. Equally, companies have to take their heads out of the sand hoping the issue will go away – the cost is too high.
Data Champions
It is not all bad news though. Some companies are turning to solutions that help ensure data protection risks are captured and addressed as well as ensuring compliance is part of everyday work.
At the heart of successful compliance are people. Utilising the organisational design of a company and working intimately with employees, by making them ‘Data Champions’ organisations can empower staff to take responsibility for adherence. Too often companies place the responsibility on one person or department to ensure compliance. However, Data Champions working in specific departments throughout an organisation can have a much better overview of where the risk lies and what needs to be implemented to close vulnerabilities.
Making compliance a part of everyday life or as it’s sometimes known ‘data protection by design and default’, means that it becomes a much more manageable task, rather than a daunting one. Alongside this, implementing a solution that can help manage the policies brought in to deal with data protection risks (and also keep a record of who owns the policies as well as, crucially, who has read and understood the policies) means that suddenly companies have a more accurate and comprehensive overview of how the company sits in terms of its adherence to regulation.
So, with Data Champions in place, a solution that allows an overview on one dashboard of risks, reports and policies and adherence part of everyday tasks, keeping all staff members advised on what the latest threats look like and what their role is in ongoing compliance is a logical next step. Education is a key element of adherence. Data Champions can speak to their specific teams to ensure that each member knows what risks impact their department and so data protection by design and default naturally comes into being.
Regulations are not going to go away, in fact for many sectors the regulatory landscape is going to get more complicated and rigorous. Therefore, turning to affordable solutions that can help ensure compliance, whilst empowering employees to take responsibility and keeping data safe is a sensible choice.
