One of many challenges for privacy professionals and boards of global corporations is building privacy programs that integrate and support business objectives and operational needs, instead of programs that exist in parallel or at odds with the business. Successfully integrating business objectives within a privacy program starts with navigating the maze of evolving privacy compliance requirements and regulators. The stakes have never been higher, especially with the General Data Protection Regulation (GDPR) ushering in the potentially hefty risk of fines up to 4 percent of global turnover.
This only speaks to one part of the challenge: mitigating enforcement risk through effective compliance. Another is balancing that risk mitigation with business-effectiveness, which requires tailoring a privacy program not only to the business considerations around its products, services, and human capital (vis-à-vis data collection, processing, use, and transfer), but also to the business considerations regarding the importance of its geographic scope of operation and expansion. The complex task of integrating the business context of geographic operational scope into a global privacy program involves more than understanding the laws and regulations across countries. Paying heed only to the mountain of requirements (even while taking stock of the variations and constant changes) can lead to unintended and costly consequences.
