The European Union has become known for its tendency toward overregulation. Well-known entrepreneur Rain Lõhmus has said that the European Union seems to believe regulations themselves are the key to innovation and success.
For entrepreneurs, every new regulation usually means yet another tedious additional task and cost, something they would rather avoid. The General Data Protection Regulation, or GDPR, entered into force back in 2018, yet companies are still struggling to meet its requirements and are often wasting too many resources on compliance.
Data belongs to people, and protecting personal data when providing any service or selling any product is becoming a hygiene factor. Consumers increasingly value companies that deal with data protection in a meaningful way.
Do I really want to give my personal data to companies that have no overview of what data they collect and for what purpose, where they store it, how long they keep it, and which third parties they share it with?
We cannot talk about meaningful data protection if, when ordering sneakers from an online store to a parcel locker, I still have to enter my home address, or if, when entering a spa, I am shown information about video surveillance with audio recording.
Confusion and Firefighting
In addition to the large number of regulations, they are often so general that entrepreneurs do not know what exactly they are supposed to do or how to comply with the new requirements. Unambiguous guidelines are missing.
As a result, entrepreneurs often take a business risk and do not deal with the issue until “someone asks” or “there is no other choice.” After all, why spend time on something that creates non-productive costs and is subject to insufficient supervision?
At the same time, when a client complains, the Data Protection Inspectorate starts asking questions, or a cooperation partner checks compliance with regulations, there is suddenly a fire to put out. Companies then rush to hire specialists or buy expensive hourly services from law firms.
There Would Not Be Enough Specialists for Everyone
Among large companies, we see a trend where every new regulation or reporting obligation leads to the recruitment of separate teams, data protection managers and officers, sustainability managers and specialists, coordinators, and so on. In addition to GDPR, good examples include the AI Act, which is closely related to data protection, or the Corporate Sustainability Reporting Directive, often referred to as ESG reporting.
With every new regulation, companies should consider what would be the most effective, sustainable, and financially reasonable way to meet the requirements. Ideally, in a way that also has positive effects on business operations and process development.
Regulations generally come and stay, so it would be smart to see them as an opportunity. Hiring a separate data protection officer is far from practical for everyone. The small size of the Estonian market also limits the number of available experts. There simply would not be enough for everyone.
A solution is sustainable only when the regulation or requirements become a natural part of the company’s everyday life. In other words, they are quickly embedded into processes. That way, the company is not shaken by staff turnover, because the solution does not exist only in one person’s head and/or on their computer.
The most expensive situation is having to start the same work from scratch because an employee leaves: getting up to speed again, making new agreements, building new teams, and so on.
What If We Digitalised It?
In the age of technology, entrepreneurs should consider whether regulatory compliance can be digitalised and whether suitable software can be chosen for that purpose. Human labour should be used for tasks that truly create value, not for managing Excel sheets or other expensive manual work.
DataVie has created data protection software whose purpose is to digitalise compliance with data protection requirements and help entrepreneurs meet those requirements in just a few hours.
Our experience so far shows that by mapping data protection and personal data processing within business operations, entrepreneurs gain not only an overview of their data protection risks, but also a clearer picture of their company’s processes, cooperation partners, and systems in use. Among other things, they automatically gain insight into weak points in their business operations and areas where resources are being wasted.
It is important to be aware of risks. At the same time, it may also be a business decision to accept a risk and not address it. If the risk materialises, mitigating it is likely to be faster because the company is not acting from a position of ignorance or making unreasonable expenses.
Forward-looking and successful entrepreneurs see the bigger picture of sustainability as more than shopping with a reusable bag or buying an electric car. Compliance with data protection requirements can become an “invisible” part of a company’s everyday life when it is digitalised and treated as an opportunity to develop business sustainability from a new, and sometimes unexpected, angle.
Personal data protection is, and should become, a normal part of providing high-quality services. Each of us expects our data to be handled responsibly.
The article was originally published in Äripäev