According to UN Trade and Development (UNCTAD) [1], 137 out of 194 countries around the world have now put in place laws to secure protection of data and privacy. While this is good news for consumers, it has created a complex path for product developers and managers to navigate. With digital and physical products often being offered globally in the first instance, compliance is a major concern.
A common and useful strategy adopted by many organisations is to focus efforts on specific jurisdictions pegged as benchmarks – typically those with the most far-reaching laws, largest markets and most active enforcements. For many industries, this will include the EU (based on its General Data Protection Regulation (GDPR)) and California (based on the California Consumer Privacy Act (CCPA)).
In doing so, product developers and managers need to consider what legal dimensions are most important and will have the greatest impact on their product or service. A useful starting point is to consider some key questions to help to define boundary conditions, as detailed below:
- What is considered personal data in thejurisdiction? Is sensitive data separated out for special treatment?
- Which governing body is responsible for enforcement and what powers does it have? How large are the potential fines for serious and/or repeated infringements?
- Are there any registration requirements for processing of personal data?
- Are there any special governance roles expected of each organisation operating in the jurisdiction?
- Are there any rules applicable, with respect to how information is collected and/or processed?
- Are there any data sovereignty requirements with respect to data collected within that jurisdiction?
- What administrative or technical security requirements are applicable to data collected and processed in the jurisdiction?
- What data breach notification requirements are applicable?
- Are there any special rules applicable to digital and/or other marketing and online privacy?
With the above in mind, organisations can start to build a concrete list of product compliance requirements that need to be fulfilled. ComplyMe.AI's Instant Answers can help you achieve this quickly and accurately. See below for a quick demonstration.
A couple of final things should also be noted with the above. Firstly, using the power of AI to process through and simplify what can be highly complex information will help you shorten your time to market and significantly lower your product’s risk profile. Secondly, if you are looking to innovate and are not sure if what you have in mind will stay within permissible
boundaries, Instant Answers can help you better understand where those lines are. Using available test cases and official regulatory guidance, you can make informed decisions based on your organisation’s acceptable risk tolerance thresholds.
Get started today for FREE, with a 7-day trial (No Credit Card Required).
[1] https://unctad.org/page/data-protection-and-privacy-legislation-worldwide