3 Key Compliance Trends for 2019

With the regulatory environment changing so rapidly, it’s hard to stay on top of the latest developments. Faced with increased scrutiny from both regulators and consumers, organizations of all sizes must reassess their business practices and take greater responsibility for their actions — or inaction, as the case may be.

This will not be easy in 2019. Regulations will continue to evolve, and meeting compliance requirements will continue to be a challenge. However, companies that deal effectively with compliance will see rewards in their day-to-day business. They will avoid costly fines and keep negative headlines at bay. To help you do that, here’s my take on the three biggest compliance trends in 2019.

1. Data Privacy Will Prioritize Consumers and the Organization

While data privacy is a popular subject nowadays, it has only become one in recent years. And within those few years, the goal of data privacy has changed significantly. Originally, the priority was protecting investors and executives, since they could be on the hook if one of their investments was found to have mishandled financial or consumer data. But as consumers have become increasingly knowledgeable and concerned about how their data is collected and used, they have started to become a greater concern.

Closely intertwined with this is the rise of data privacy legislation and frameworks. Between international regulations like GDPR, sector- or industry-specific compliance frameworks like NIST or HIPAA and statewide legislation like the Consumer Privacy Act introduced by California in 2018 (becoming law in January 2020), most organizations processing consumer data have to comply with some type of regulation.

So why are consumer knowledge and regulations impacting data privacy prioritization so strongly? Reputation and monetary hits. No company wants to announce to the world that it just got breached and allowed all of its customer data to be exposed to hackers. Consumers will lose trust in the organization and may even leave it for a competitor. In addition to the PR hit, it also means a loss in profit and a distraction for the organization. And with the potential fees and settlements the company may have to pay as a result of the breach, that’s even more money down the drain. Even a small breach of consumer data could take years to recover from.

This is why organizations must take consumer and organizational data privacy more seriously than ever before. The best ones will do two key things:

Implement new initiatives to ensure consumer data is considered during the business development process.

There is a pressure here; there is always the possibility that new data privacy regulations overreach to the point where companies miss out on new growth opportunities due to their efforts at compliance. But when data privacy is done right, it is possible to protect consumer data while still growing the business.

Train internal end users around data privacy.

Whether those employees are in support, marketing, sales or engineering (amongst other historically non-customer-facing departments), these training courses are designed to help them understand exactly what they can and cannot do with customer data and how to avoid a catastrophic incident. Employees are a company’s first line of defense, and if they aren’t familiar with basic security best practices, hackers are sure to infiltrate the organization.

2. GDPR Will Remain Ambiguous

2018 started with everyone in freak-out mode over GDPR. There were so many unknowns about the new regulation, and no one wanted to get caught off guard. This helped raise the profile of compliance teams, as every organization put its best foot forward to make sure it was actually doing what it needed to do. In a sense, GDPR was the catalyst that the compliance world needed.

Since GDPR became law, that worldwide panic has steadily decreased. And while, on the one hand, it’s nice that organizations don’t feel as alarmed as they used to, on the other hand, the decrease is likely because of the ambiguity that still surrounds GDPR attestation. Just over six months after the regulation went into effect, organizations are still confused about its practical application, attestation practices and whether they’re compliant. This confusion likely persists because we haven’t seen the major threat of GDPR truly come to fruition: the devastating fines that were predicted.

We have started to see enforcement notices, which could be a step toward fines, but we certainly haven’t witnessed anything close to the once-feared penalties that could add up to as much as 4 percent of a company’s annual revenue. And while I certainly don’t want to see companies experience breaches severe enough that they incur this fine, my concern is that if we fail to see proper enforcement of GDPR regulations soon, it could lose its intended effect in the years ahead.

3. The C-Suite Will Band Together for Compliance

CISOs, CIOs and even CEOs are feeling the heat in the new regulatory environment, and this is getting everyone on the same page. C-suite executives are finally realizing that compliance is not a part-time job and that there must be a significant investment in compliance to satisfy requirements and gain value from it. We’re even starting to see position requirements and title designations built into legislation and regulations.

For example, the New York State Department of Financial Services has introduced a number of new cybersecurity regulations that apply to financial companies doing business in New York. One of those regulations states that these companies must appoint a CISO. Furthermore, this officer must report directly to the board of directors and issue an annual report highlighting the company’s cybersecurity compliance and identifying risks for potential breaches.

Another positive is that all the various frameworks and regulations have vastly increased collaboration among organizations’ teams. All things considered, this is good news for most organizations. The effort to achieve compliance builds cross-organizational alliances. This trend is especially prevalent between CIO and CISO departments. Historically, these two have had differing goals, but regulations like GDPR are forcing these departments to become codependent.

This is shaping up to be an exciting year for compliance. More conversations about compliance are taking place inside and outside organizations — and more companies are reaching out to technology vendors to make compliance easier on them. Compliance may not be the coolest tech topic in 2019, but at the rate fresh ideas are emerging and innovation is taking place, compliance will certainly have a bright future and play a prominent role in business for many years to come.