In recent years, protecting consumer data has not only been a major concern for consumers themselves, but also for government bodies around the globe. The EU’s General Data Protection Regulation and the California Consumer Privacy Act are two of the most prominent examples of legislation designed to ensure consumers have more insight into and control over their data and that any information they choose to share is safeguarded by the businesses that collect it.
Most technology companies have welcomed the guidance and clarity provided by carefully crafted legislation, but even so, there’s no doubt that complying with varying (and growing) national and regional privacy statutes brings an added layer of challenge when building new technologies. Below, 20 members of Forbes Technology Council share strategies to help tech companies balance pursuing innovation and ensuring compliance to continue to grow and serve their customers.
1. Prioritize Consumer Ownership And Consent
Companies must prioritize consumer ownership of their data and their consent to its use. Empowering users with greater control over their data and enabling them to make informed decisions about how data sharing benefits them fosters a customer-centric approach to innovation. This approach aligns technology benefits directly with the needs and preferences of users, building trust and driving sustainable growth. – Christina Cai, Lydia AI
2. Embrace Privacy By Design
The privacy-by-design approach is one strategy every company should adopt to address the challenge of balancing innovation and compliance. The principles of this approach include being proactive, not reactive; having privacy as the default setting; embedding privacy into product design; ensuring end-to-end security and transparency; and respecting users’ privacy by offering strong privacy defaults, appropriate notice and so on. – Velu Palani, HCSC
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
3. Implement Protection Practices In The Early Stages Of Development
Companies trying to balance innovation and compliance with data privacy rules should implement data protection concepts and practices in the early stages of development. Ensure your products and services comply with data privacy rules from the outset. This reduces future changes and increases users’ and regulators’ trust, enabling innovation in a secure and compliant framework. – Mike Housch, Dark Matter Technologies
4. Keep Your Users Close Throughout The Process
Bring your developers and your users together to talk directly as early as possible in the design process to identify privacy opportunities and risk factors in the product’s intended features. Then, be sure to keep the data owners as close as possible throughout the design process. – Molly Rauzi, Gagen MacDonald
5. Allow Users To Opt In; Purchase Existing Data
Regulations such as the GDPR are necessary with the increased blurring of the line between ethics and innovation. Allowing users to opt in when collecting new data continues to be an ethical and accepted strategy, along with buying existing opted-in data from credible sources. I also foresee improved machine learning models that can operate with far fewer datasets, shifting the mindset that more data is necessarily better for predicting outcomes. – Preeti Shukla, JustFund
6. Respect Your Users
It is not just privacy by design that is needed—one has to treat the users of one’s service with the respect one would want for oneself. A new service model involving deep respect for users and their data is key to reimagining the internet and the Web the way people want them to be and ensuring the internet remains a platform for innovation and creativity. – Andrew Sullivan, Internet Society
7. Be Transparent About Data Collection And Use
Companies must be transparent about the data they collect and how they use it. This approach requires auditing policies, communicating protections clearly to users and developing products using only essential data. Ensuring that external data processors also adhere to privacy regulations can expand a company’s ability to innovate while responsibly leveraging data. – Dan Pinto, Fingerprint
8. Include A Range Of Data Management Capabilities In New Designs
Considering changes in regulation around data privacy, such as the EU’s new NIS2 Directive, it is imperative for companies to incorporate privacy by design into their software development processes. As new applications are being developed, engineers need to include such capabilities as data inventory, encryption in transit and rest, data purge capabilities, and role-based access control mechanisms. – Carlos Morales, Vercara
9. Implement Encryption And Key Management Solutions
A robust data protection strategy is essential for companies looking to successfully strike this balance. Implementing encryption and key management solutions as part of this strategy ensures sensitive data and all paths to it remain protected while meeting compliance and best practice requirements, providing companies with a secure and controlled environment for innovation to thrive. – Todd Moore, Thales Group
10. Leverage Visibility Controls
Embrace privacy as an opportunity—rather than viewing privacy regulations as obstacles, see them as opportunities to build trust with your customers. Leverage visibility controls to monitor and manage access to sensitive data. By implementing granular access controls, you can limit data visibility to authorized users, reducing the risk of unauthorized exposure. – Ganesh Kirti, TrustLogix
11. Seek To Fulfill One Or Two Critical Principles Of Data Privacy
Data privacy regulations revolve around the principles of data capture, processing, retention and, most critically, distribution. Look to fulfill one or two of these principles, as an attempt to cover all of them will lead to gaps. This is especially true given the ever-changing amendments to regulations and, hence, the need for continuous alignment. – Sameer Zaveri, Datamotive.io
12. Conduct A Cost-Benefit Analysis
Identify areas where you can invest a small amount—say, 10 cents—in innovative technologies that help meet privacy regulations while still generating significant revenue (say, $1.10 per customer). Such trade-offs can help reduce your liability and expedite your project’s time to market. Additionally, it’s crucial to anticipate your regulatory responsibilities to meet audit standards and regulatory expectations. – James Beecham, ALTR
13. Make Robust Data Privacy A Differentiator For Your Brand
Today, having a well-thought-out privacy and cybersecurity approach to data collection is a brand differentiator. Instead of thinking of it as a blocker or a cost, think of it as part of your brand and just build it into your processes (particularly product development). Make sure your marketing content highlights your efforts. – Caroline McCaffery, ClearOPS
14. Employ A Multicloud Storage Strategy
Compliance regulations often require organizations to store and process data within specific geographical regions or comply with multiple data sovereignty laws. Employing a multicloud strategy can allow organizations to select cloud or on-premises providers with data centers in different locations, enabling compliance with regional and international data residency requirements. – Thomas Robinson, Domino Data Lab
15. Use An Event Bus Architecture
Consider using an event bus architecture that requires individuals to subscribe to data or information updates. This way, you know where your data is going and how it is being utilized. Employ an architecture that enables people to get real-time access to the data they need and does not allow access unless you know who is accessing it and why. – Richard Ricks, Silver Tree Consulting and Services
16. ‘Shift Left’
By “shifting left” and adopting a privacy-by-design approach, integrating data protection measures (such as automating policies and controls), and encouraging cross-functional collaboration between appropriate business lines from the outset, tech companies can use compliance to fuel innovation, align and adapt to regulations, and—perhaps most importantly—build trust among users. – Kim Bozzella, Protiviti
17. Minimize Data Collection And Use
If your business model doesn’t hinge on profiting off of user data, there’s no need to collect and store it for a prolonged period of time. Collecting minimal data allows you to avoid compliance headaches and minimize the damage of a potential data breach. With blockchain and modern transport protocols, you can build apps that require no phone number or email for account registration. – Konstantin Klyagin, Redwerk
18. Appoint A Go-To Privacy Expert
Assign a dedicated privacy role. This can be a part-time task for someone on your legal or product management team. Having a go-to person for privacy issues ensures teams are educated and guided on these matters. This individual doesn’t need to have all the answers but should have the resources and knowledge to find them, keeping product development aligned with data privacy regulations. – Ilia Sotnikov, Netwrix
19. Engage In Policy Discussions
Picture steering a ship through uncharted waters—that’s how we navigate the sea of data privacy regulations. Our strategy? We’re not just map readers; we’re cartographers. We proactively shape our tech landscape by engaging in policy discussions, ensuring our innovative solutions are compliant by design, not as an afterthought. – Sandro Shubladze, Datamam
20. Make Privacy Your Top Priority, Not Just An Equal Priority
Asking how to balance innovation with compliance is the wrong question. Instead, we should ask, “How can companies put privacy at the center of their thinking and their development to create products and services that balance innovation with a deep respect for individual privacy needs?” That will lead to innovation that benefits society rather than weakens it. – Tod Loofbourrow, ViralGains
Read the full article here