An approach to complying with the Personal Data Protection Law

How much do we talk about risk? GDPR vs. the Chilean law

As a lawyer, I get asked a lot how to comply with the upcoming Personal Data Protection law. The usual answer is that there is a set of requirements that are hard to assess without relying solely on lawyers and their reading of the rules.

So a solid strategy is to learn from the European experience and understand how those rules can give us specific tools to properly assess our own compliance.

The reforms in the bill (Boletín 11144-07) are inspired by the European Union's General Data Protection Regulation (known as the GDPR). That regulation sets the protection standards organizations have to follow in their relationship with consumers inside the EU.

Beyond protecting information, reducing risk is a central focus. In fact, the word “risk” appears 75 times in the GDPR, while in the Chilean bill it shows up just 18 times. There is significant progress, but it looks like risk will not take center stage in the discussion.

Reducing risk is the outcome of a process organizations know well, one that is more developed in areas such as operational, financial, market and technology risk. And everything points to personal data protection creating more risk, under the new regulation, in the various areas that already handle that data. A potential fine would affect financial risk, customer loss and security breaches.

So an excellent starting point is to define the organization's risks properly. If the risks you have identified do not include those tied to data protection, you have a fundamental problem in how you identify and assess risk. It is hard to determine which mitigation measures to take when you do not understand the risks.

A data management policy is not enough

Organizations tend to downplay risk. The first phase of mapping it properly is understanding what data we hold (in a general sense), what we use it for and where we store it. Answering those questions lets us move forward on aligning our processes, policies and control systems with the GDPR and the bill.

But trying to answer the question "what data do we have?" can raise more questions. Not knowing what we hold can create the same uncertainty as not having data at all.

Not being able to drive change effectively and actively is a key concern. Having a data management policy is not enough: it has to be backed by the right use of technology and correct storage (data at rest), among other things. Complying properly with the bill (or with the GDPR) therefore requires a fundamental first step tied to transparency and management. Auditing what already exists and defining what is truly essential for the organization and what is not are essential steps.

From there, it is data specialists and decision-makers who define a workable adaptation and compliance plan. Up to this point, corporate and data governance decisions should be the main focus.

To comply or not to comply, that is the question

There is an apparent obligation to comply in order to avoid penalties. Part of what the rules demand is enforcing the law to prevent abuse or uses that run against it.

When it comes to personal data protection, though, we need to widen the perspective.

A user is not simply a user, but a person who needs the best possible conditions to thrive. Beyond regulatory compliance, organizations should aim for the right use of data. Can the road to compliance also be a road to generating wealth inside organizations? The reality is that it can. Managing data properly lowers operating costs and organizational risk.

So along this road it is not enough to understand and confirm that we have users' consent to process their data, the legitimate interest to process it, that the information is available to people in a simple and accessible way, which third parties we will transfer it to and how users can exercise their rights. There is also internal work to do, far more about managing and handling data properly than about displaying it.

Part of the requirements is therefore closely tied to how users manage their data and to consent. But another crucial part of the process is technical teams being able to handle data properly, without straying from the commercial purpose and, at the same time, building a high level of trust in how this information is used across the company's different areas.

Back to the original question of how to comply with the upcoming personal data protection law: the answer will depend on each organization's context. Compliance will require coordination between company leaders and the organization, plus the right adoption of concrete legal and technical measures to guarantee effective implementation.

If you want to read about the technical challenges and the questions they raise, I recommend this post on how to protect data privacy when using and training language models.