Data privacy is far more than just the security and protection of personal data. It all boils down to how organisations are using that personal data. Organisations need to process personal data in an ethical and legal manner. That could mean not bombarding customers with unwanted SMS marketing messages but it could also mean simply not sharing personal information with third parties without the customer’s consent. It doesn’t mean that marketing is now forbidden under data privacy laws but it does mean that organisations need to be transparent about what personal data they are capturing and how it’s going to be used. Many organisations recognise the significant risks of cyber attacks and data breaches but fail to understand what else is required to safeguard what is referred to as the “rights and freedoms of individuals”.
Why is data privacy important?
Companies that fail to protect personal data and comply with data privacy regulations aren’t just risking financial penalties. They also risk operational inefficiencies, intervention by regulators and most importantly, permanent loss of consumer trust.
Data protection regulators may enforce mandatory audits, request access to documentation and evidence or even mandate that an organisation stops processing personal data.
Non-compliance with the law could result in brand damage, loss of consumer trust, loss of employee trust and customer attrition.
Fines, and in some countries potential prison sentences, could be enforced depending on the violation. You may also experience loss of revenue and high litigation and remediation costs.
Most data privacy laws give people more rights over their data, such as the right to access their data or the right for it to be deleted. This can be a significant operational burden if it is not implemented effectively.
Ten steps to an effective data privacy programme
< Back
< Back
[+] Read More
Key global and regional data privacy laws
- GDPR
- Qatar
- Bahrain
- Egypt
- UAE - DIFC
- UAE
- Saudi Arabia
- Oman
GDPR
General Data Protection Regulation (GDPR)
As the global gold standard for data protection, the GDPR represented a significant evolution in the landscape for personal data protection when it came into force on 25 May 2018.
The law includes stringent requirements for organisations who process personal data collected in the EU, with many multinationals in the Middle East undertaking GDPR compliance projects.
The law introduces strengthened rights for Data Subjects such as the right to access their data, the right to be informed via privacy notices and the right to rectify or delete their personal data.
Potential fines under the GDPR can reach €20m or 4% of global turnover - whichever is greater.
How we can help
We start by helping put the data protection requirements in the context of the business. We have developed a five step approach to transforming privacy programmes, with tools and accelerators to assist the process.
Risk analysis and data discovery
What you will get
- Stakeholder engagement and communications plan
- Personal data inventory
- Data flow maps showing the movement of personal data from collection through to disposal
Gap assessment
What you will get
- Control gap analysis
- Risk assessment based on current and planned future uses of personal data
Target operating model and programme design
What you will get
- Detailed remediation project plan with identified organisational impact
- Cross-functional working group established
Programme implementation
Areas of focus
- Strategy and governance
- Policy management
- Cross-border data strategy
- Data life-cycle management
- Individual rights processing
- Privacy by design
- Information security
- Privacy incident management
- Data processor accountability
- Training and awareness
Ongoing operations and monitoring
What you will get
- Defined ongoing monitoring programme
- Tracking and retesting of non-compliance
- Protocols for changes to policies and procedures
Contact the team
Follow us
