Compliance – depending on who you ask within an organisation, it is often considered a bugbear. This as it often necessitates the negotiation of complicated regulatory hurdles, which if not handled correctly can result in a hefty fine and in some cases, even worse.

In recent years we have seen the need for compliance increase at a rapid rate, with the General Data Protection Regulation (GDPR) influencing how data is regulated in the European Union, forcing many organisations to react in a timely manner.

Closer to home the Protection of Personal Information Act (PoPIA) came into effect last year and while many companies scrambled to ensure that they are compliant, many more are still in the dark as to whatever  is required.

While this may result in frustration for many, in the view of enterprise software specialist Micro Focus, compliance should be seen as an opportunity, not a burden.

This was the topic of conversation at a recent Cyber Resilience (CyberRes) roundtable where industry experts and C-suite executives looked at how to trigger this paradigm shift and turn burden into opportunity.

The Fear Factor

While there are indeed many approaches to compliance, each uniquely tailored based on what types of data a company handles or indeed what their needs are, one element that needs to run throughout is ownership and a desire to remain fully compliant.

Speaking anecdotally regarding what she has seen in the market, Anna Russell, worldwide VP for Sales and Strategy at CyberRes VOLTAGE (a Micro Focus line of business), notes that risk is a great motivator in terms of adhering to GDPR in the United Kingdom.

“There are several reasons as to why GDPR is so heavily adhered to in the UK, but one of the most significant was a dreadful breach that impacted one of the major retailers – Morrisons. It was an internal breach where a disgruntled employee took every single managers’ salary, printed it off in an Excel file and shared it to every single printer that Morrison owned,” she explained.

“That incident was before GDPR came into play, but a lot of the GDPR aspects that are happening today are based on litigation and if I’m a Morrisons employee, I am still entitled for the next five years to sue the company for letting my personal information be shared,” she added.

Russell also pointed out that while that ongoing litigation may not be the biggest monetary loss in terms of GDPR fines, it is undoubtedly the biggest loss for the retailer to date. This is what is driving such a strict adherence to data regulation in the UK, as a breach could spell the end of your organisation.

“What we are seeing with the likes of British Airways and EasyJet, these big brands that have all suffered leakages, I am entitled to sue them for allowing unauthorised access to my data. So this is now the next big thing in terms of insurance, where class action lawsuits as a result of breaches are coming to the fore,” highlighted Russell.

“As soon as those fines and penalties start to be enforced, is when you will see a shift in perception with CEOs and CTOs starting to think that ‘we need to do something different’,” she posited.

Are You Ready?

The CyberRes executive says that the difference in question will be implemented in one of two ways – with technology or with better practices.

Focusing directly on the aspect of technology, and in particular organisations that are taking an operationalisation approach to tackling data privacy and compliance, Greg Clark, worldwide director of Product Management – Security, Risk and Governance, asks roundtable attendees one question.

That is whether they think their organisation is in the right posture to handle what is next in terms of privacy and compliance?

The general consensus around the table was mixed, with some confident in their preparedness while others had hoped that they would be ready when the need arises, along with a few noting that the process is very much a journey that holds no definitive yes or no.

Regardless of what phase you are in the process, CyberRes and by extension Micro Focus, is of the opinion that an innate understanding of regulation is critical. This as you are now not thinking about what will happen should you get breached, but rather view it as an incentive.

An analogy thrown around at this point is to rather think of compliance as a carrot instead of a stick. Here Russell zeroes in on some of the solutions that CyberRes is developing to better assist companies in their data privacy and compliance journeys.

“It is about knowing the value of what you do rather than enforcing because you need to,” she emphasises.

Aiming to help companies operationalise data compliance, CyberRes is expertly equipped to provide the right tools. To find out more about its services related to data privacy and compliance, head here.