Gero Decker

Since the introduction of internet technology, industries have undergone huge changes, not only the way they operate but their approach to compliance and regulatory change and internal cultural attitudes towards data.

More than a third of business organizations spend a minimum of a day each week monitoring and regulatory change, while two-thirds expect regulators to introduce even more regulatory information in the coming year, according to Thomson Reuters.

With the rapid digitalization of enterprise services and the consequent creation of data, physical products aren’t necessarily the most valuable asset enterprises have to offer anymore.

The availability of data, from customers’ spending habits to credit applications, provide invaluable insight that can be used to refine and market existing products and services, as well as inform the development of new technology.

There’s a huge amount of risk associated with this data, however. In a highly regulated industry, mistakes can come with expensive and litigious consequences. With such sensitive information about customers’ records, the utmost care must be taken in the management and protection of this data, without limiting the ability to innovate.

That factor alone makes it easier to restrict access to information to mitigate the risks. However, in the long-term, shutting employees out and having departments work in silos is counterintuitive to collaboration and, consequently, growth.

So then, how can we keep customer data safe and protected, while still enabling enough flexibility to collaborate and create new technology? Here are four methods:

1—Clearly define and set the expectations

Develop a system that classifies the sensitivity level around different data sets and how they should be used, stored, accessed and shared. It should comply with the requirements of your region (for example, it may need to be GDPR-compliant in certain markets) and future-proof your organization so that it enables for flexibility, transparency, and scalability. This framework should also be able to adapt to regulatory and audit requirements as they change and arise. (GDPR, or the European Union’s General Data Protection Regulation, is a set of data privacy standards designed to protect online buyers.)

Often key bodies will require that you keep documentation detailing exactly how data is used in day-to-day operations. They may also require you to prove communications with staff regarding how this framework was done, potentially requiring formal records of this.

Defining expectations and rules around data-sharing is the first thing to do before granting access to sensitive data to employees. Most important, this framework should be core to your onboarding process for new hires and should be revisited frequently by employees.

2—Implement business processes

Process-driven transformation can enable businesses to significantly boost operational efficiency and better meet customers’ needs, allowing for deep data analysis and insights into behaviors. Along with centralizing processes to focus primarily on the customer, business process management (BPM) can help B2B companies innovate faster, improve the launch of new products into the market, and reduce both risks and costs.

However, despite this, BPM is not being used to its full potential. Global research suggests improper documentation is a problem for 94% of respondents in the finance industry and 89% in insurance.

3—Invest in the right equipment 

Once the rules and processes are running, ensure they’re complemented by the right tools. Often large organizations use intranets, databases (or third-party software) to create single sources of knowledge within their intranets that allow them to communicate with staff to reduce the risk of non-compliant activities. For third-party central databases, ensure you have crucial security features like permission management at a granular level to control and monitor who has accessed the data and how it was used.

Don’t forget to implement basic security protocol, from secure passwords, 2-factor authentication and frequent updates across the organization. Human error is the leading cause of data-breaches!

4—Create a culture of responsibility

Company cultures that lack accountability are a major source of risk for organizations. A company’s culture dictates and influences risk-taking behavior, so it’s the responsibility of leaders like chief compliance and risk officers to ensure they’re advocates for desirable behavior in terms of policy adherence, risk mitigation, whistle-blowing and responsibility. Make sure you take the time to educate all staff across the organization of the importance, risks and consequences that come when handling sensitive data. Does your team fully understand their responsibility in using financial information safely? Would they feel comfortable having a stranger use their financial data?

Data-friendly behaviors need to be advocated, from the top of the organization. Even with the most sophisticated processes or state-of-the-art management, automation and security tools, if top executives aren’t the ultimate champions of data responsibility in enterprises, not only will the potential of this invaluable information never be fully realized, it could cause a variety of headaches and serious issues for the company and its customers.

Gero Decker, who holds a PhD in business process management, is the co-founder and CEO of  Signavio, a provider of business transformation software and services.