Turning data governance policy into practice

Five practical and actionable priorities from leading UK companies

Here’s the story you don’t often hear about data governance…

It’s the bringer of opportunity to ensure your organisational success.

A lot of media coverage to date has focused on scaremongering around breaches and fines, but data management is fundamental for organisational success because once you’ve distilled the actionable insight, you uncover and can harness the value locked within it. Marking the next phase in data governance, 2020 will be the year when data shifts from being a liability to a business asset, where compliance moves beyond a tick-box exercise, and where data governance policy turns into practice.

“GDPR formalises the move of our profession away from box ticking or even records of processing, and instead seeing data protection as something that is part of the cultural and business fabric of an organisation.”

Elizabeth Denham, Information Commissioner’s Office

For the practical implementation of effective data governance programmes, data professionals have 5 key priorities:

1. Win hearts and minds around data governance: The senior leadership team has to be united in making employees aware of their personal responsibilities around data governance policy.

2. Align with company mission and values: Just as the company values guide how decisions are made, they also need to guide how data is used as part of business-as-usual.

3. Empower ownership and responsibility: Data privacy is everyone’s responsibility. To encourage ownership, make data real by showing it’s not just a number, it’s a person’s actual identity.

4. Automate data governance policy and embed within business processes: Having visibility over the entire data estate, across structured and unstructured databases, allows you to reveal data, manage it and mitigate risk.

5. Excite the organisation around data as a valuable asset: To better engage the C-Suite, reframe data so it’s perceived as a positive business driver and a bringer of opportunity, rather than a business liability.

Report methodology

The insights shared within this report were acquired during a roundtable discussion with a select group of data specialists, from leading UK companies, which was hosted by Exonar and chaired by its CEO and Founder, Adrian Barrett, and Alexander Brown, Partner in the Information, Communications & Technology Group at Simmons & Simmons.

“In the past two years, I’ve been witness to not only great change, but also a great deal of consternation around how to employ best practices around data governance in light of GDPR. It is clear that 2019 was a banner year for data privacy, and this will only continue forward into 2020 as our approach to data governance and regulation matures. As we enter a new year, I hope we will see change become practice, and policy an integral part of business-as-usual.”

Alexander Brown, Simmons & Simmons.

Also present were: 

• Lead data protection counsel and DPO, healthcare industry. 
• Privacy business analyst in a leading European investment and asset management company. 
• Expert risk, privacy and compliance director of an international telecommunications company. 
• Fraud, risk, and security expert, multinational telecommunications conglomerate. 
• Compliance counsel at a global commercial real estate company. 
• DPO at a global financial services organisation.

"Having a strategic data protection policy in place not only ensures the safety of the data, but also optimises its use to achieve strategic business objectives. That is why data protection policy must be so much more than a tick-box exercise. That policy must also be integrated at the highest levels of the organisation as business-as-usual.”

Adrian Barrett, Exonar 

Priority 1: Win hearts and minds around data governance

According to our panel, the need for data governance is now generally understood and accepted, but not all organisations are aligned on how to roll it out as part of business-as-usual. In many cases, it’s still left to one part of the business to manage, despite it being something that touches every function, and that every employee is responsible for.

For many compliance officers around our table, a key challenge in the post-GDPR world has been enabling data governance by winning the ‘hearts and minds’ within the organisation. During the discussion, one of our specialists, a compliance counsellor at a global financial services organisation, described how it’s common for employees to be unaware of their personal responsibilities regarding data governance policy.

Action i: Get the board on board

Our panel all agreed that change needs to come from the top, because if the senior leadership team isn’t united, pushing the data governance agenda and educating employees on its importance, will be virtually impossible. Simply enforcing policy isn’t enough, either. The key to getting buy-in is to provide insight around how data governance applies to each specific job function, as well as the wider organisation.

One of our panel, a fraud, risk, and security expert for a multinational telecommunications conglomerate said: “When GDPR was coming down the pipe, we had a problem with implementation. We needed to change the culture, so we used an internal communication channel and our C-level video chats each quarter to talk about GDPR. This way, we got it into the culture. We created one-pagers about what you needed to know and created a culture where people bought in.”

Things to think about:

1. Can you value the risk in your data? The ICO fines for Marriott and BA equated to ‘say’ £1 for every record affected. Work out how you’d calculate yours.
2. Work out the total cost of a data breach. Here’s a handy calculator from the Ponemon Institute https://databreachcalculator.mybluemix.net/
3. Look at how and where a breach would damage your reputation. Read our blog on data breaches and trust: https://www.exonar.com/data-breaches-and-trust-what-can-the-ciso-doto-manage-reputational-risk/ 

Action ii: Make people think differently about data – It’s not just a risk, it’s an asset too

Our panel was united in their view that simply stating the importance of data isn’t enough. First, the senior leadership team needs to buy-in to the idea that data is valuable, but only if it is managed and actioned appropriately. The panel agreed that data is a key business enabler that organisations can’t afford to get wrong. To win those hearts and minds, data governance professionals must focus on positioning data policy as a business facilitator and a bringer of opportunity, rather than a difficult and painful process.

“There are different perceptions of data governance processes depending on different parts of the business. I want the DPO and the data protection counsel to be seen as enablers, helping the business move forward.”

Lead data protection counsel and DPO, healthcare industry

“There are only so many times you can warn people about the ramifications of having data which you don’t have the right to retain. You need to take a hearts and minds approach instead. So, in our business we changed track and asked our chief execs what they wanted to achieve with our data in the next few years. And off the back of that, we saw change at the exec and senior leadership team levels. The focus changed to seeing data as intrinsic to the business, as the enabler and opportunity, and not one to waste. Ultimately, we communicated our compliance message around business success and business objectives,”

Privacy business analyst in a leading European investment and asset management company

Things to think about:

1. Use your internal communications channels to communicate to everyone – can you use company newsletters, video channels, internal chat forums?
2. Get creative with your messages and campaigns to remain top-of-mind.
3. Could you align to existing internal focus or programmes on data as an asset?

Priority 2: Align with company mission and values

Some members of the panel talked about how their most successful data privacy programmes had aligned to the company’s corporate vision.

But more important than that, the programmes aligned to the company values. Those values are the guiding principles that govern how decisions are made. In their experience, only when data governance programmes aligned with the company values, could they achieve buy-in and adoption across the business.

Action i: Use a cross-functional group to put the plan into action

An expert lead compliance counsel at a leading multinational telecommunications provider explained how they put this into practice. Only when they had mapped the programme back to their company values of trust and allegiance to client interests, could they set the context and establish gravitas around data governance. A cross-functional group was then able to successfully put the plan into action. And by aligning to the company’s values, there was never any ambiguity on the need for data governance. Just as a company’s vision and values drive the big strategic decisions, it’s equally important that they underpin decisions taken lower down the chain of command as part of business-as-usual.

Things to think about:

Who would you have in your cross-functional group?

We’d suggest someone:

I. Responsible for interpreting regulation and creating data governance policy (e.g. the DPO).

II. Responsible for understanding data risk, e.g. the CISO.

III. Responsible for implementing tools and processes to comply with regulation and risk, e.g., the CISO, Governance or IT.

IV. In infrastructure ownership.

V. Representing the business, in other words the people who have to work with those tools and processes on a day-to-day basis.

Action ii: Keep reinforcing your data principles across the business

The data protection counsel and DPO in the healthcare industry shared how their corporate vision and principles define everything they do in relation to data. 

“You’re more likely to get buy-in if you tie it into this vision and company principles. This worked really well at my company.”

A legal counsel gave the example of a company that has 

“Strong data principles that were set 50 years ago and have never changed. They stick to them even if they cost the business money. It’s super important that everyone follows principles from the top. It’s important to distil this into the principles of the business and to live them top-down.”

Things to think about:

1. Keep reinforcing your data principles across the business.
2. Get the internal comms team on side to help run campaigns.
3. Organise short bursts of training and nudges throughout the year as opposed to one course.
4. Rather than use a traditional ‘carrot and stick’ method for enforcing policy, why not try to make it fun and engaging? For example, if you leave your laptop open at Exonar, you get ‘sieved’. At the end of the year, whoever has been ‘sieved’ the most wins the golden colander in recognition for being the leakiest.

Priority 3: Empower ownership and responsibility

One of the big issues surrounding data protection for our panel is the lack of ownership within an organisation. When data becomes an asset that is owned by someone, individuals are reluctant to take ownership. So the big question is…

How do you establish ownership of data across the organisation?

Because when ‘the sh*t hits the fan’, it’s the person closest to the data who is accountable for it, despite data governance being everyone’s responsibility.

Action i: Clearly appoint your data owners

A privacy business analyst in a leading European investment and asset management company, said it is very important that there’s data ownership in his company. “If you manage a database, you are responsible for ownership of that data. If the ICO came in, you have to have someone managing the data.”

However, a legal counsel summed up what often happens, when he said, 

“People can be territorial about their data until it goes wrong. Then it’s not their data.”

What our panel agreed was that data privacy is everyone’s responsibility, even though ultimately there will be one data owner who is accountable. It’s why communicating the importance of data stewardship – from the senior leadership team right through to the frontline staff – is crucial, and why it needs to be reiterated again, and again, and again…and again.

Things to think about:

1. Make your data protection rules simple: create 5 rules, not 5 pages of rules. The simpler your data privacy programme is, the more chance it has to be successful.
2. Put data into categories, highlight the characteristics of those categories and how you expect the data within them to be handled.
3. Write short policies that are realistic, useable and memorable.

Action ii: Help the team understand why the rules relate to their role

This can be done in several ways, but the key is to build relevance into that communication – don’t just tell people why data governance is important and that they need to be doing it, win them over by showing them how it relates to their specific role or function.

At the mid-level, one tactic that has worked well for several DPOs on our panel, is raising awareness around the real threats associated with improper data practices. By highlighting that data isn’t just numbers or information, it’s a person’s actual identity, it really brought the seriousness of data stewardship to life. Making data real moved the process of data governance from being viewed as a burdensome exercise to a powerful responsibility.

Things to think about:

1. Consider tools like Exonar Reveal that empower your people to take ownership and responsibility for data.
2. Monitor compliance to your data governance policy through a ‘workflow engine’ that identifies where they aren’t being followed, and nudges people to do the right thing. We enable this through the Exonar Resolve product.
3. Think about how different technologies can work together to deliver on your objectives, for example data found to be sensitive is passed to another system for classification and encryption.

Action iii: Develop bespoke training programmes tailored to each role

A panellist from a telecommunications company said the key to engaging internal teams is making training around data principles fun, and not using generic materials. He said the key is to target smaller areas specific to what people are working on, because generic training doesn’t resonate.

“We ran internal campaigns that brought GDPR awareness to life. We built in real examples in ongoing newsletters that came out weekly.”

Fraud, risk, and security expert, multinational telecommunications conglomerate

He described how his company developed bespoke training programmes that were relevant to the different levels and business units:

• The training employees received provided a broad overview and underpinned the relevance of data governance to their particular role.
• The training materials ‘spoke’ to employees in the same casual, irreverent tone that the company was famous for, so they truly understood data governance and their role within it.
• The actions to be implemented were connected directly to each role, which made people feel personally accountable.

Things to think about:

1. Build simplicity and relevance into your communications with teams.
2. Help them understand why the rules relate to their role and the importance of customer trust.
3. Develop and evolve training programmes, keeping them relevant.

Priority 4: Automate data governance and embed within business processes