Data privacy laws and data quality: what to fix first

Data privacy laws are usually discussed as a legal topic: policies, consent wording, contracts. But many of their requirements can only be met if a company knows what personal data it has, where it is stored and whether it is correct. That is a question of data quality.

This article shows where privacy laws meet everyday data problems and what to put in order first. As the main example we use the EU's General Data Protection Regulation (GDPR), because many other laws around the world follow similar ideas. Exact rules and deadlines differ from country to country. This is a general overview, not legal advice: for your specific case, consult a lawyer.

The GDPR in brief

• Scope. It applies to organizations in the EU and can also reach companies elsewhere that offer goods or services to people in the EU. A law can therefore apply to you even if you have no office in that country.
• Timeline. It has applied since 25 May 2018.
• Penalties. The highest fines reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher.

Where privacy law meets data quality

Inaccurate data must be corrected

Personal data must be accurate and kept up to date, and people can ask for mistakes to be fixed. For a company with the same customer in the CRM, the loyalty system and the billing system, this is not a simple edit. Without a single customer record, the correction reaches one system while the old value lives on in the others.

Requests from individuals have a deadline

People can ask for access to their data, correction or deletion. Under the GDPR, the company generally has one month to respond, with a possible extension. To respond, you need to find all records about one person. Duplicates, different spellings of a name and phone numbers in different formats make that search unreliable.

A breach leaves little time

Under the GDPR, a breach that creates a risk for people must be reported to the supervisory authority within 72 hours of becoming aware of it. Within those hours you must understand which data was affected and whose. A company with no inventory of its data will spend that time just trying to answer the question.

You must know how data is processed

Companies generally have to keep a record of processing activities and assess the risks of high-risk processing. This is hard to do honestly without data lineage: a clear picture of where data comes from and where it goes. Reports and exports that nobody has documented are the usual blind spots.

Consent has to be traceable

Where processing relies on consent, the company must be able to show that it was given. Marketing is a typical example. If the consent status lives in one system and the mailing list is exported from another, you may contact people who have opted out without knowing it.

What to fix first

1. Build an inventory of personal data

List where personal data is stored: core systems, spreadsheets, exports, backups and external services. Record which fields are held, why, and for how long. This is the base for almost everything else.

2. Assign owners

Every set of personal data needs a responsible data owner on the business side and a data steward who looks after it day to day. Without them, a correction or a deletion request has nobody to go to. See how the two roles differ.

3. Clean up the customer master record

Decide which system is the source of truth for customer data, and how duplicates are detected and merged. This is the classic MDM task, and it pays off well beyond compliance: reports and marketing also become more accurate.

4. Set quality rules for key fields

Phone numbers, ID numbers, email addresses, consent status and dates need clear formats and automated checks. Start with the fields used to identify a person. A data quality audit shows where the problems are.

5. Document the data flows

Describe how personal data moves between systems and which reports and exports contain it. Copies you do not know about cannot be corrected or deleted.

6. Rehearse the procedures

Take one test person and try to find all their data, correct it and prepare a response. Run a breach exercise as well. A rehearsal quickly shows where the process breaks while the stakes are still low.

Summary

Legal documents explain what a company has promised to do. Data quality determines whether it can actually do it. An inventory, clear owners, one customer record and automated checks make requests, corrections and breach response far easier in any country, and the same work improves reporting.

We can help with the data side of this work: see our Data Security and Data Quality services. The legal assessment of your obligations remains with your lawyers.

Sources

• General Data Protection Regulation (EU) 2016/679, EUR-Lex