After a company identifies the data privacy framework that works for them, the next step is to consider the right privacy strategy. In simple terms, a privacy strategy covers the company’s approach in communicating and obtaining support for the privacy program within the organisation.
Remember, to drive the privacy program is a team sport, and that requires a strategy. Any winning football team, for example, will have a specific winning system. In a similar vein, building a privacy strategy may mean a plethora of things. For example, it may mean changing the collective mindset and perspective of an entire organisation.
To protect personal information in any organisation, everyone—bottom-to-top or vice versa—has a function.
The most important part is the management support. Management must approve funding to equip the privacy team, privacy-enhancing technologies, support privacy initiatives like training and awareness, and create methodologies to hold staff within the organisation accountable for following company policies and procedures.
Imagine a company that claims that they have a clear desk policy and yet, staffs leave pieces of paper with personal information on their desk. That’s a strategic failure on many levels: leadership, monitoring and auditing. So, in essence, a privacy strategy will communicate company’s approach and punitive measures in cases like this.
There are no shortcuts. Every staff within an organisation contributes to the success and failure of any privacy program. A weak link in the organisation can break any vital privacy program. Research shows that human error accounts for fifty-two per cent of the root causes of data privacy breaches.
So, before any organisation begin their data privacy journey, the management team must understand that the criticality of their involvement in the project. The practical contribution of management drives every privacy program.
There are specific challenges in building a privacy program. The most important one is gaining consensus from the members of the organisation. In fieldwork, normal business-as-usual (BAU) activities limit the total contribution of specific stakeholders, and as such, slows the implementation of the privacy strategy. It is crucial, therefore, to have dedicated individuals that can drive the privacy program.
The one-on-one informal conversations with executives within the organisation who have accountability for information management and security, risk, compliance, or legal decisions are foundational steps in privacy strategy. Here, one can find the present state of the company’s data privacy strategy.
These conversations usually reveal a sense of which executive will or should be the program sponsor. For example, a particular company decided to use their Head of Information Technology Officer as the data privacy program sponsor because she understands the complexities of embedding technical steps in data privacy compliance. Influential program sponsors have experience with the organisation, respect their colleagues, and can access the budget or final budgetary decision-makers.
I mentioned above about teamwork. As such, companies must build the right privacy team to formalise the organisation’s approach to privacy. There are many factors companies must consider to create the right team. An important question to find out is the positioning of the privacy team and what authority it will receive. Also, where should privacy team be placed: Legal or IT umbrella?
Companies must integrate essential steps when creating the privacy team. First senior leadership involvement is critical. Second, identify various stakeholders within the organisation whose roles feed into the privacy structure. Third, company stakeholders must develop internal partnerships with different staff members to ensure that privacy controls are adequate. Lastly, collaboration is vital in making any privacy program work.
Defining the right privacy strategy and creating the right privacy team plays their role in ensuring that companies treat privacy as a business function. People make up companies, and their contribution will ensure that any organisation’s approach to privacy adequately meet regulatory requirements and broader business objectives.
The case for government’s engagement in business