Personal data protection: knowing the business vs. regulatory compliance
One of the biggest challenges in implementing Chile's personal data rules is moving from compliance on paper to compliance that is connected to how the business actually operates.
Yes, exactly as you read it. I know it sounds complicated, and it probably is. It is very hard for an organization to have a formal, approved compliance system (such as an Infringement Prevention Model) and for that to mean, in practice, that compliance has genuinely permeated the organization's culture. That is today's big challenge for all of us who help organizations implement this regulation and cover the last mile.
The practical gap: why you have to identify the processes that handle personal data
Looking closer, many of us who work in privacy have probably noticed that a Personal Data Protection Policy (or Privacy Policy) can contain a set of statements that reassure third parties, and data subjects in particular, that their data is collected fairly and lawfully and used in line with the rules. But once you go deep inside an organization, you find that the problems do not come from complying with the rules on paper. They come from internal processes, which sometimes are not even defined. Inside those processes there is often no clarity about who owns the (personal) data or which processes use it, that is, which processing activities are involved.
This point strikes me as central. Good privacy governance on its own will not reduce the risk of leaving your data ungoverned, but it can be a good start. Mature levels of data governance do not guarantee lower regulatory non-compliance risk either, but they do let you work toward a systemic view of the organization and, above all, identify which areas are critical (and risky) on this front.
Why understanding the business matters for complying with the Law
What will matter is the difference between two kinds of organizations. Some understand their operations, connect them to their business and adjust them so they comply with this law. Others start from a “check list” of the Law and simply impose rigid policies with no relation to their processes. That second path will undoubtedly create enormous risk in future enforcement reviews, because a supervisory authority can see the disconnect between theory and reality.
To close, here is one piece of advice from my professional experience and from what Europe has gone through, which organizations should keep in mind for this challenge. Build a deep connection between knowing the business, knowing the (personal) data it holds and knowing the operations where that data is used. That connection responds realistically to what the Law demands and avoids siloed work across teams. It also lets you demonstrate a proactive approach to managing the risks that arise naturally from the activities the organization carries out.
