The pandemic and Brexit have been the catalyst for significant shifts in customer demand and consumption patterns, from a 35% rise in online shopping, to a preference for trusted brands.

All this change is set against a backdrop of massive technological and regulatory transformation. Take the UK’s newly announced data protection law reform, which aims to strip a series of “administrative burdens” from data protection (GDPR), enshrining the concept of more flexible, risk-based ‘privacy management’ into legislation.

Progress to make regulation less burdensome, yes. The problem, you may ask? At present, there is £11 billion worth of trade that goes unrealised around the world due to barriers associated with data transfers.

With the possibility of GDPR laws being revised, it’s time for businesses to assess how they can navigate current and future regulations, whilst also remaining competitive and compliant.

In turn, it means businesses have to start seeing regulation as a facilitator rather than inhibitor.

Deciphering GDPR

Since it became enforceable in May 2018, GDPR has been the cause of much criticism, praise and questions.

In an increasingly data-driven world, it was originally devised to give EU citizens greater control and protection over their personal data and how it is used by organisations.

Simultaneously, GDPR aimed to make companies more responsible in safeguarding user data by implementing tough penalties for those who fail to comply. Violation of the rules could lead to a maximum fine of the greater of £17.5 million or 4% of annual global turnover.

The UK previously adopted these GDPR principles into law through the Data Protection Act 2018. However, following Brexit, whether the UK should continue to adhere to GDPR has been much debated, with the UK government believing these reforms will allow for greater innovation and competitiveness for British businesses.

If Britain does take the leap and decide to wave goodbye to GDPR, it’s important that as a nation it considers the effects this will have on businesses for years to come.

As the UK looks to set its own digital trade strategy, whether regulation mirrors GDPR or diverges away from it, one thing is clear: companies want clarity.

Due to the many important areas such as data transfer and processing, marketing and sales that will have to adapt to the changing regulations.

The world’s most valuable resource – data

In the digital age, personal data is something of a hot commodity, being described as the ‘world’s most valuable resource’.

However, data’s high value also increases its vulnerability as it is often subject to theft or misuse.

A recent example is the NHS scandal, where the private data of thousands of patients has been wrongfully shared with strangers. As data breaches continue to rise, consumers are becoming more aware but also demanding to know how their data is being used. The EU can be expected to keep a closer eye on those countries it has adequacy agreements with in order to protect its own citizens rights.

Before GDPR, collecting personal data on digital forms would often be masked by unclear opt-out buttons or tick boxes. Consumers often would not realise what they were signing up to and it was the cause of many junk emails and spam.

Recommended

• Contributed | Diversity: The secret sauce for tech sector growth?
• Facial recognition firm facing £17m ICO data handling fine
• GDPR and the Cloud | How Brexit will affect data storage

Under GDPR, businesses were required to opt-out consumers as standard and clearly mark where they can opt-in to receive emails and other brand communications.

This has meant companies had to adapt the way that they carry out activities such as marketing and sales, as it now had to seek explicit permission from prospects and customers confirming they want to be contacted. If the proposed reforms are passed, these will be the areas of business that are most affected.

One of the criticisms of GDPR is how arduous it makes collecting data, as companies have to justify their reasons for needing it. This leaves consumers with the task of having to manually opt-in to accept things like cookies every time they access a website.

The UK government argues that by revising regulation in this area, there will be a smoother customer experience, paving the way for greater innovation.

However, businesses also need to consider the effect this will have on data privacy and the responsibility they owe to its consumers to enforce this.

The impact on data adequacy

Arguably, the most significant implication of the new reforms is the impact it will have on data adequacy.

Changes to regulation risk altering the EU findings that the UK has adequate data protection laws, which currently enable the free transfer of personal data from the EU to the UK.

Much of Britain’s trade is facilitated through cross-border data flows with businesses relying on the ability to transfer personal data about their customers or workforce to offer goods and services. Or to run basic internal processes such as cloud-based email or file storage.

If the UK were to lose its data adequacy status this would have a detrimental outcome, effectively acting as a barrier to trade and putting the UK at a distinct competitive disadvantage to other countries in possession of data adequacy.

Future-proofing against data reform

While the need for these reforms can be debated, they are an ever-present possibility. Therefore, businesses need to become adaptive to any changes that might occur.

Take multinational organisations operating in heavily regulated industries such as telco, healthcare and financial services. For these organisations, the UK and EU are but two of the markets they have to contend with from a data privacy and regulation perspective.

Having a holistic view of how they manage, govern and secure data is critical to allow for both agile decision making and futureproofing.

These types of organisations, and others who want to ensure they are safeguarding themselves against data protection reform, will benefit from a holistic approach to their data architecture and strategy; one that can be seamlessly applied across the hybrid infrastructure which will underpin the deployment of data and analytics.

This approach not only delivers the flexibility to deal with ongoing data reforms with minimal impact but also ensures changing business imperatives can be met by deploying and moving data as well as analytics across hybrid cloud.

Creating adaptive, reactive businesses

Whatever the changes that end up being made to data protection laws in the UK, this latest consultation serves as a wake-up call — you can no longer manage data in a country-by-country way.

As digital trade becomes ever more valuable to the global economy, regulations will evolve and change, so no matter what size a company is, it needs to adopt a holistic approach from the get-go. One that enables data to cross international borders whilst respecting regulations.

The consequences of failing to adhere to these regulations can be dire for businesses, with financial or reputational damage being a real possibility. Therefore, organisations need to prioritise being adaptive.

Why? Because if they do this then they won’t be holding their breath every time the political landscape, or regulations, shifts, and changes.