There is no data protection or privacy management problem that a lack of understanding, a jaded attitude, selfishness or a moment of arrogance can't make just that little bit worse.

You know you need to comply with the regulations, everyone keeps telling you so. Suppliers, advisers, industry peers. They all talk a good game.

But how do you get there? It's easy to say, "you must be compliant".

It is much harder to actually do.

Even privacy professionals can find compliance perplexing, so there's no shame in admitting when you need some help. Then there is the problem that as soon as you say the words, "GDPR" or "compliance" you can watch people's faces glaze over.

Data protection "compliance" is tricky

This is a fluid and changing discipline:

There is uncertainty about the laws and their interpretation appears to vary; technology constantly changes and evolves; even the notion of "compliance" is a fleeting moment in time - you can be compliant today and fall out of compliance tomorrow.

All of which means that compliance is decided on a case by case basis. The answer to whether or not you are "compliant" will often be, "it depends...".

A box ticked during an audit or inspection can be out of date before the ink has dried.

You need to create a constant state of vigilance and readiness.

We found the answer is to take your eye off the notion of, "compliance" for a while and focus instead on the individual.

There is one very good reason for this: You see, to concentrate on compliance with data protection regulations, or to try to meet the demands of the regulator, is to look in the wrong direction. Here's why:

Neither the regulations nor the regulator actually have the personal data your business needs, they can only define how you use data or tell you if you're getting it wrong.

It is individuals who have the choice about where and how their data is used. They decide whether or not you can use it. Which means it makes sense to focus on what they want and what they are legally and reasonably entitled to expect from you. You need to influence them so they can trust you with their information and you can form a relationship with them.

When you do this, your efforts are transformed by being a responsible data user.

This is a better place to be, a benign face of data protection and privacy which builds trust. Making it easier to get people on board and to align with your business than any notion of raw "compliance".

And when you get it right, compliance becomes a happy outcome of what you're doing anyway. Everyone wins.

You can - with Responsible Data Use.