Many times the alignment with GDPR requirements is perceived as a compliance challenge only.  What few realize from the very beginning is that GDPR does not involve a push-up effort, after which the relaxation is coming. It’s not an IT project, nor any simple modification of privacy policy on an e-commerce site. GDPR is the beginning of a process that should become irreversible, and for this, it needs a source of energy to keep it moving. The energy source for maintaining GDPR compliance for the entire lifecycle of a business is the organization’s internal capacity to maintain compatibility. And this is called Company Culture.

We are talking about GDPR more and more. And this is good because we still need awareness. Unfortunately, most of the messages are focused on the punitive value of the regulation. And that’s right, because the fines announced are scary, even for a bigger company. For the vast majority, however, a penalty of € 10,000,000 actually means getting out of business. Those who will have what they pay will face a big black spot of reputation, which will affect the trust of their clients, which creates the premises of a threat even bigger than the fines themselves.

These threats should generate a big concern at the executive levels first. Here are no longer only quick steps to modify few web pages and ad-hoc staff training. Organizations need to change their mentality and decision-makers must be an example. The success of a long-term GDPR project is based on the building of an organization-wide culture where people first think about how they would like their personal information to be processed. Companies must adopt this attitude when handling the personal data of customers, employees, and other subjects. It’s not just about the threat of financial penalties. It’s a business continuity and building a trusting attitude.

Individuals need to trust the companies to whom they provide their personal information and need to trust that these data operators have the ability to manage this information properly and safely. One of the GDPR’s novelties is the introduction of the accountability principle. The concept is not new. But for the first time, it becomes an explicitly free principle. The GDPR accountability goes beyond compliance with data protection principles, as it involves a change of culture. Any data controller or data processor has to prove not only that they are responsible for personal data protection but also to prove that they can support this responsibility. In order for this extended responsibility to be assimilated into our organization, we need a cultural and organizational change.

To create a GDPR culture, companies need to adopt a proactive, methodical and responsible approach to compliance, a privacy culture for personal data protection. If you want people to change their behaviour, you have to motivate them to want to do this; they have to understand why it is important. This change is a challenge if they cannot connect privacy risks to their own roles and private lives. Personalized training for roles or characters and the use of relevant examples is, therefore, a good practice. To effectively educate your staff, work closely with and connect with internal teams – people from HR, accounting, logistics, technical teams, but especially from internal communication teams.

Now that you have built the data privacy culture, you need to embed and support it. To do this, you will need to:

• Define clear periodic and point assignments;
• Create regular campaigns;
• Build awareness of privacy in new business environments or new employees.

If it has not already been made, compliance with GDPR should be a key priority for all organizations, regardless of size, industry, or geographic location.