HBR and RSA’s Paper on the Impact of GDPR on Business

Earlier this year, the Harvard Business Review published a paper prepared by RSA that discussed the impact of GDPR on business, and how companies can thrive under the rules.

The paper provides advice for companies getting started, and what needs to be in place for them to comply.  It also reflects on the “new normal”, and how companies will have to adopt new practices across the organization in order to remain compliant (e.g., Sales and Marketing will need to collect and maintain opt-in’s for the names on their mailing lists).

The final paragraph says:

Data privacy and security of personal data, then, are likely to become ever higher priorities for government as well as individual corporate customers in the years ahead. At the same time, both government and consumer demands on data—for access, mobility, and analytics—will only increase. This creates a tension, especially for large companies that manage large amounts of data, because “minimization—only collecting what you need and keeping it only as long as you have a legitimate reason—is at odds with innovation,” observes Skivington.

The route to successfully navigating between these two objectives starts with knowing the data you hold and providing notice to all EU data subjects to whom it belongs. The rest follows.

By articulating the opposing tension between the market demands for creative use of data, against the requirements to minimize data collected and retained, RSA correctly highlights one of several ways in which the strategic direction organizations want to pursue (with respect to data use) is increasingly at odds with the rights ascribed to data owners.  They don’t recognize that reconciling these opposing forces is central to the CDO’s responsibility and demonstrates the need to closely align the CDO and CPO.  And while the RSA paper focuses on GDPR and the rights to privacy of individuals, it is clear that the obligations imposed by all data owners will follow the same trajectory – especially as data is increasingly regarded as a leverage-able asset by more and more organizations.

The proverbial trains have left the station – one on the data-as-an-asset track and the other on the data-obligations track.  Both are equally important and must be reflected in the CDO’s vision and strategy.

Contact me at james@jhoward.us