Data Privacy Compliance: A Blueprint for Global Corporates  

Data privacy compliance is becoming increasingly complex. Regulations are more stringent and comprehensive than ever. Meanwhile, data protection and compliance teams face growing data volumes, lack of specialized tools, tight deadlines, and little to no insights to allow them to act proactively. Often, teams need to tackle all these challenges manually, and have hard time keeping up with changing regulations and day-to-day data privacy tasks. 

In this guide, we introduce a different approach: we’ll look at how data protection, compliance, and legal teams at global corporates can use data privacy automation tools to protect their most valuable assets. 

The current data privacy landscape

Remote working is here to stay, which means data volumes have increased and data privacy has become more challenging to solve. Data has become a currency of its own. With millions of data points created each day, data matters as much as any other company resource — if not more. As data helps companies move from educated guesses to precise business decisions, companies are eager to protect their data, and there have been major shifts in how data privacy is regulated. 

Starting with the Health Insurance Portability and Accountability Act (HIPAA) and Gramm-Leach-Bliley Act (GLBA) in the late 90s, all the way to the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) introduced in 2018, data privacy regulations are becoming more stringent. And these are only some of the regulations that affect the processing of data on a global scale. 

More and more countries, states, and jurisdictions are following suit by setting out their own data privacy rules. As these rules are becoming more complex, fines are increasing and data privacy is becoming costlier to handle. 

According to Finbold, a UK-based financial sector reporting portal, EU fines in Q3 2021 rose to around €985 million — almost 20 times higher than the cumulative fines imposed during the first half of the year.  

It comes as no surprise that 80% of corporate legal departments are concerned about changing data privacy laws in their jurisdictions. According to the 2021 ACC survey of Chief Legal Officers, over 50% believe that data privacy protection rules will pose a challenge to their organizations. 

Risks and challenges faced by data privacy officers and chief compliance officers

As data privacy becomes more challenging to manage, data privacy, compliance, and legal teams face increasingly difficult tasks: they must not only address numerous questions within their organizations, but also keep an eye out on ever-changing regulations, setting and maintaining the data privacy course in line with the new rules. In this section, we look at key risks associated with data privacy. 

Lack of specialized data privacy compliance tools and processes

First, some companies lack the right tools and processes to handle data protection. This risk underlies a number of data-related processes, including:

• Data collection and processing.
• Reporting a data breach quickly enough.
• Identifying data records that have been breached.

The volume of data that needs handling has long-surpassed manual capacity.  

In fact, it’s more than just a matter of efficiency: the current data privacy legislation specifically dictates that companies need to have the right systems and processes to handle data privacy protection. Some regulations, like the GDPR, require organizations to “install appropriate technical and organizational safeguards,” whereas the California Consumer Privacy Act (CCPA) is more specific in requiring companies to provide transparent privacy notices depending on the way the data is collected. 

While some organizations still rely on traditional custom software solutions, these are expensive, time-consuming, and difficult to maintain. By automating data privacy efforts, as described below, companies ensure that all employees have guidance on how to act in case of a data breach, how to report on them in real-time, and how to identify areas of risks across jurisdictions and teams. 

Lack of a clear reference point for employees

As companies bring on more employees, the risk of data breaches increases. Each employee handles data to some extent — whether by replying to customer complaints, approving a leave of absence, managing vendors, or hiring new staff. This means that each task an employee undertakes is a potential data breach.  

This problem is further exacerbated by a lack of clear guidance on how employees should conduct themselves when it comes to data privacy protection. In global corporates employing tens of thousands of professionals across jurisdictions, employees might not be aware of their obligations, and a handful of compliance/data protection officers hardly suffice in keeping data privacy risk at bay. 

Finding clear guidance on how to act in a breach situation, whether through malicious software or the accidental loss of data or hardware, is also a challenge from an employee perspective. A self-service solution is a valuable tool to invest in, as it provides guidance and removes a hurdle for employees to report breaches 24/7. Without a self-service focal point accessible to employees at all times and for various scenarios, there is risk that data can be unintentionally compromised, leaked, or destroyed, causing huge reputational damage and fines. 

Growing data volumes

The paradigm shift to data as a company’s most valuable asset is a double-edged sword. On the one hand, it’s easier to make sound, data-driven business decisions — but at the same time, companies need to manage data privacy compliance with a volume of data that’s growing like never before. 

To start, companies need to take care of internal data: proprietary systems and tools, employee records, and all data sets that guide decision-making. Next up to manage is customer data and the rights and privacy of users, which companies need to invest heavily into protecting. Finally, there is the partnership level: data pertaining to all partners, vendors, and related outsourced professional services that a company uses. These three layers are interconnected and data flows through all of them, all the time. 

In some jurisdictions, such as the majority of Europe, companies need to be aware of all their data flows and processing activities, lest they face huge fines under the GDPR. When factoring in remote work, hiring a global workforce, and tracking online transactions, it becomes a real feat to ensure all data processing is accounted for. 

Tight deadlines for data privacy reporting

While data breaches can’t always be pre-empted, timely reporting on them makes a difference. Reporting is one of the pillars of data privacy protection. It is also one of the criteria on which regulatory sanctions are imposed. 

However, reporting deadlines are short – under the GDPR, a company has 72 hours to collect all information on a data breach, notify the persons impacted, report it to the data regulator in its jurisdiction, and come up with a plan of action. 

Reputational damage, monetary fines, and a blow to business

Data privacy non-compliance brings other risks as well. At its core, it shows that the company wasn’t prepared enough to tackle and organize its data privacy protection efforts. This sends a poor signal to customers, partners, and investors.  

The monetary fines for non-compliance are just the tip of the iceberg. Wider effects quickly appear: reputational damage and doubtful customers often lead to a drop in share prices. And there’s hard data that support this cycle. 

Comparitech, a UK-based tech research company, looked at company stock prices prior to and several times after the reported data breach and concluded that company stock prices are hit hard following a data breach. Their most recent study looked at 40 of the world’s largest companies and discovered that: 

• In the long term, breached companies underperformed the market.
• One year after the breach, share prices both fell 8.6% on average and underperformed the NASDAQ by 8.6%.
• Two years after the breach, the average share price dropped by 11.3% and underperformed the NASDAQ by 11.9%.

While drops in stock prices are likely to diminish over time, the initial blow following a data breach has a big impact in the two to three years immediately after the breach. 

Lack of insightful data: no knowledge of where the risk is

Another issue with manual data privacy is the lack of knowledge of where risks lurk. If compliance officers and data privacy officers tackle data privacy compliance manually, the same breach or violation of privacy laws may repeat itself in a different jurisdiction, or within a different team. 

To stomp data privacy compliance threats, companies need to know where the risks lie. As a rule of thumb, this means that data privacy officers need to take into account large-scale regulations, such as the GDPR and CCPA, and cross-check them with local regulations, industry-specific standards, and finally their own set of in-house policies, to create an intricate web of requirements and steps for everyone in the company to follow. 

Data protection teams also need to audit each processing activity within the company to understand where data is being transferred or used. But since these regulations and rules frequently change, it’s impossible for most organizations to manually update all data privacy efforts and ensure they are synced and compliant. 

How companies handle data privacy protection today

While data privacy compliance is picking up as a dedicated in-house function, there is still a long way to go before these teams can respond to all data privacy risks efficiently. Currently, there are two broad approaches to data privacy compliance and protection: 

First, some companies choose to implement rules manually using a team of data privacy professionals with compliance, legal, or tech backgrounds, who read through each piece of legislation, browse through data records, and manually map the data in the company’s possession. They are also swarmed with questions and requests from all levels of the company — from their procurement team sourcing new partners to HR signing on a new hire in a new jurisdiction. 

These processes are fraught with risk. Manually handling data privacy is costly and error-prone. Some privacy rules might be overlooked, some data unmapped, and some requests not answered on time. Deadlines get missed and reporting might be incomplete. As a result, the company could face heavy fines, a damaged reputation, and a drop in profit and shares. 

On the other side are companies that rely on external counsel. By turning to law firms, companies entrust their data privacy to experts in the field. This does provide more protection against data privacy risks, but is quite expensive. At the same time, some companies don’t want external parties to gain complete insight into their privacy operations and would prefer to keep it all in-house. 

So what is the way forward? If companies can’t afford to pay external counsel and don’t want to di the necessary work manually, where can they turn? 

Data privacy automation

What is data privacy automation?

Data privacy automation means automating the processes of handling, collecting, and storing data, as well as meeting regulatory obligations, notice and reporting deadlines, and managing consent with respect to third party data. 

How does this translate to practice? Think of data privacy automation as document automation combined with automated decisioning, based on various customizable risk thresholds and rules that you can set as needed. 

Examples of data privacy compliance tools

Data privacy automation may sound abstract, so let’s look at some examples to see how companies can make the most out of their data privacy efforts and ensure compliance at all times, without overburdening data protection and compliance teams or other units across the company.

Standard Contractual Clauses Generator

Data transfers between jurisdictions are a heavily regulated topic, with fines of up to €20 million. In a nutshell, companies need to follow a set of requirements when transferring data between the EU and other countries. When this is done without a dedicated system, companies risk supervisory authorities suspending data transfers indefinitely. More specifically, this approach holds the danger of being unable to keep up with demand and producing faulty SCCs that slow down supply chains, and potentially jeopardize global operations. 

By automating the generation of Standard Contractual Clauses and quantifying data transfer information in a database, companies speed up data transfers and can process data without disrupting the usual business workflow. An automatic privacy shield navigator for staff can further safeguard the transfer of data, specifically between the EU and the US. (For organizations subject to the CCPA, a CCPA Privacy Notice Generator is another complementary defense against non-compliance on the consumer-facing side, which replaces the need to manually draft privacy notices for individual websites, online forms and other communications.) 

In practice, a company can create and populate a legal template for transferring multiple agreements, ensuring all data transfers are standardized and automated. But that’s just one part of the process: since companies must first carry out transfer impact assessments, they can connect and automate both processes. 

Instead of a manual review of data privacy laws by in-house experts in each case, the compliance / data protection team can create a single template that encompasses all applicable rules and regulations, to be replicated in each subsequent request. In doing so, the company builds a standard yet flexible single source of truth, which changes to provide advice based on individual requests. Once the assessment is complete, the conditional logic can be applied to all other parts of the process, enabling the creation of a legal document unique to each user’s choice. 

The data privacy automation benefits don’t end there. At each stage, every employee can get guidance on how to answer questions and how to proceed. This enables accuracy throughout the process, but also lifts the workload for the legal, compliance, and data protection teams. 

Data Breach Reporting Assistant

Reporting is a key step in data privacy compliance. By automating data breach reporting, companies can easily meet tight reporting deadlines, minimize the impact, and proactively act on potential breaches.

By replacing manual Excel- and email-based processes, the automation of data breach reporting lets companies assess suspected breaches against the applicable regulatory framework, triage information, and automate necessary documentation based on highly customizable risk-scoring models. 

These incidents can also be documented in a full audit trail. This lets the compliance/data protection team easily create a report and dashboard to visualize the type of breaches, the number of incidents, and the source of breaches, which helps build knowledge around data breaches and lets the company build a system to take action before – rather than in response to – an incident. 

What are the benefits of data privacy automation?

Data privacy automation brings benefits at several fronts. In short, it lets companies:

Save time

By automating their data privacy efforts, companies cut time previously spent on manual handling of data privacy related queries. Data privacy automation also saves the time of data protection officers and compliance officers, who no longer need to address each request, and instead can focus on tasks that require their involvement.

Improve internal data privacy compliance

Another benefit of data privacy automation is that knowledge on data risks becomes accessible to everyone, without the need to ask compliance and data protection teams about every question or doubt on how to proceed. Creating standardized interactive workflows lets employees across the company self-serve, i.e. get guidance based on their specific question or situation. This makes data privacy more concrete instead of a policy that’s seldom read. It becomes a handy companion that lets all employees act in line with regulations and the company’s data privacy rules. 

Make knowledge accessible

Another benefit of data privacy automation is that knowledge on data risks becomes accessible to everyone, without the need to ping compliance and data protection teams for each question or doubt on how to proceed. Creating standardized interactive workflows lets employees across the company self-serve, i.e. get guidance based on their particular question or situation. That way, data privacy becomes more concrete, and moves from being a policy that’s seldom read. It becomes a handy companion that lets all employees act in line with regulations and the company’s data privacy rules.

Ensure a full audit trail

Through data privacy automation, companies can ensure a full audit trail on each incident, meaning they can track and document all steps, actions, and assessments, and keep them in a centralized audit trail. This allows companies to document compliant processes and actions, both in case of a breach and pre-emptively. 

Know where risk lies

Data privacy automation lets companies not only analyze previous data breaches and incidents, but also act on insights from documented processes and filed requests, and identify the areas and processes where risks are most likely to happen, working in advance on remedying those obstacles.

How law firms and professional service providers support corporates with data privacy compliance automation

As the new Standard Contractual Clauses (SCC) entered into force, companies hurried to facilitate the flow of data in line with new rules. The previous SCC version, which was not updated after the GDPR came into force, already needed a major overhaul when the European Court of Justice published its Schrems II decision and forced companies to immediately review their international data transfers. 

The team at the global law firm, Fieldfisher, built a free digital tool that helps clients navigate the new SCC rules. Running on the no-code platform BRYTER, mySCCcreator allows users to assemble the right contract template with clauses relevant to each case. By answering questions, users cover different data transfer constellations, resulting in a smooth transition to the new standards. 

“We were able to develop this tool incredibly quickly by getting together with a number of experts in their respective fields. In just two weeks, the effort of our lawyers as domain experts around data privacy was combined with the technical knowledge that Fieldfisher has built up in-house, as well as help from our document processing specialists.

Oliver Süme, Partner, Technology, Outsourcing and Privacy, at Fieldfisher

PricewaterhouseCoopers (PwC) has also used BRYTER to create tools that help clients overcome data protection concerns. One of PwC’s first tools developed with BRYTER is “Rule Keeper,” which provides clients with a variety of applications dealing with recurring legal issues in the areas of tax, compliance and data protection. Rule Keeper is designed to handle and resolve these issues quickly and efficiently. 

Developed before the impact of COVID-19, this tool has become even more useful in its wake, as all business areas and legal departments are doing their bit to deal with a multitude of questions from clients and employees. As many companies try to keep up with fast changing regulations, applications like Rule Keeper provide the support they need. 

Building a case for automation

Data privacy automation transforms organizations on several fronts. First, it allows businesses to improve operational efficiency: data protection and compliance officers need to spend less time addressing incoming requests on data protection, while all employees, units, and departments have accessible advice on how to proceed when handling data. 

Second, by automating data privacy workflows, DPOs and CCOs build a knowledge base of data privacy-related risks. Capturing and storing historical data on the type of breaches, as well as most vulnerable processes and workflows, allows data protection and compliance teams to be proactive in identifying risk scenarios and act on them before a breach takes place. 

Finally, it enables everyone in the organization, from finance to HR to marketing to sales and executives, to be less caught up in manual processes, and frees up time for more strategic work.

Data privacy compliance checklist

While data privacy compliance requires a comprehensive strategy to manage, the basic starting points are similar for most organizations. We’ve provided a checklist below to help you get your data privacy compliance processes off the ground: 

• Hire or appoint the right team to manage data privacy compliance. 
• Become familiar with relevant regulations and requirements. 
• Identify the risk areas in your organization: Where and how is customer data being stored? How might a breach occur? Is consent being granted for collected data? Consider conducting a gap analysis and auditing existing data flows. 
• Develop policies to address known risk and prevent unknown risk. 
• Educate the staff about the steps they need to take to help the business remain compliant. 
• Adopt automated tools to help streamline the collection and storage of data and provide self-service resources to the business. 
• Stay informed, conduct regular audits, and update processes as needed. 

The journey to data privacy compliance starts here 

There’s no doubt about it: data protection is as high-impact as a priority can be. But by automating the parts that lend themselves to automation, companies ensure their experts are involved when needed, and are otherwise working more on the strategic tasks that require their expertise.  

This allows businesses to be both efficient and compliant when it comes to data — their most valuable asset — and minimizes the risks of improperly managed data and non-compliance. 

To learn how to start using data privacy automation in your organization, book a demo with one of our experts today. Or if you want to learn how you can build digital applications without any coding, read our No-Code and Workflow Automation guides.