Every board says culture matters. I have stopped believing them.
That is not because I think directors are dishonest. Most genuinely believe culture sits at the heart of organisational success. My scepticism comes from somewhere else. I have watched too many organisations publish beautiful statements about purpose, integrity and values while quietly rewarding behaviour that undermines every one of those principles. Eventually I realised that culture is not what a board writes. Culture is what a board permits.
Working in privacy has given me an unusual vantage point into corporate leadership. Most people assume my job revolves around legislation, regulators and compliance. It certainly involves all three, but they are rarely the real story. Privacy simply exposes something much bigger. It reveals how an organisation behaves when commercial ambition collides with restraint, when growth competes with judgement and when no customer is sitting in the room to ask why their information is needed in the first place.
That is why I have come to regard privacy as one of the purest measures of corporate culture.
Every strategic initiative eventually arrives at the same crossroads. Marketing wants richer customer insights. Technology wants more data to improve artificial intelligence. Product teams want fewer controls because speed wins markets. Commercial teams want friction removed from every customer interaction. None of those ambitions are unreasonable. In fact, many are entirely necessary if an organisation intends to remain competitive. The defining question is whether anyone around the board table still possesses the confidence to ask whether collecting more data actually creates more value, or simply creates more risk.
Those conversations fascinate me because they reveal something directors rarely acknowledge publicly. Privacy is almost never the issue under debate. Leadership is.
A board that consistently places governance beneath commercial urgency has already communicated its culture, regardless of what appears inside the annual report. Employees notice which executives receive bonuses despite questionable decisions. They notice which functions are invited into strategic discussions only after products have been approved. They notice whether governance professionals are expected to influence decisions or merely document them. Over time those observations become institutional behaviour, and institutional behaviour eventually becomes culture.
This is precisely why I think boards misunderstand the phrase “tone at the top”. Tone is not established through speeches delivered by the Chair or values printed inside reception areas. Tone is established every time directors decide whether to ask one more difficult question before approving the next strategic initiative. Employees are not studying the values statement. They are studying the board.
That reality should concern every director because trust is becoming one of the few competitive advantages that cannot be replicated quickly. Technology can be copied. Products can be improved. Pricing can be undercut. Reputation, however, compounds slowly and disappears astonishingly fast. Privacy sits at the centre of that equation because customers increasingly judge organisations not by what they collect, but by the judgement they exercise when deciding what they should never have collected in the first place.
Perhaps that explains why I find the phrase “privacy compliance” increasingly inadequate. Compliance describes the legal minimum. Leadership demands something much higher. The most trusted organisations I have encountered do not ask whether the law permits a particular use of personal data. They ask whether the decision reflects the character of the institution they are trying to build. Those are profoundly different conversations, and only one of them creates enduring trust.
If boards genuinely want to lead on culture and values, they should spend less time measuring engagement scores and more time examining the decisions they reward. Culture is not created by aspiration. It is created by repetition. Every promotion, every investment decision, every product launch and every governance challenge teaches employees what the organisation truly believes. Privacy simply makes those lessons impossible to hide.
That is why I no longer ask whether an organisation has a strong privacy culture. I ask a far simpler question. If every customer could watch the board deliberate over the use of their personal information, would the discussion strengthen trust or quietly destroy it? I suspect the answer to that question tells us far more about culture than any board dashboard ever will.
- business a.m. commits to publishing a diversity of views, opinions and comments. It, therefore, welcomes your reaction to this and any of our articles via email: comment@businessamlive.com
Michael Irene, CIPM, CIPP(E) certification, is a data and information governance practitioner based in London, United Kingdom. He is also a Fellow of Higher Education Academy, UK, and can be reached via moshoke@yahoo.com; twitter: @moshoke
You are the light, just dusty