How data protection and compliance are connected

To better understand the difference between data protection and compliance, it is important to know the following: compliance refers to adherence to all internal and external rules and legal requirements. This means that compliance managers must ensure that all regulations—including the General Data Protection Regulation (GDPR)—are consistently implemented across every area of the business, from recruitment procedures in HR to expense reports in sales.

Management system for data protection and compliance 

Structured compliance management not only ensures adherence to laws, but also offers significant competitive advantages. Public contracts are often awarded only to companies that have implemented an appropriate management system. Data protection, which safeguards personal data, is a central aspect of this. Since May 2018, the General Data Protection Regulation (GDPR) has provided the legal basis for data protection in Europe. Data protection is therefore an integral part of compliance. However, there are also many points of intersection between data protection and other areas of compliance. The following example illustrates this.

Introducing a whistleblowing system 

The EU Whistleblower Directive requires companies in Europe to introduce reporting systems. Even before it came into force, such systems were an essential part of the compliance structure. They make it possible to identify risks and violations at an early stage through anonymous reports from whistleblowers. For this to work effectively, the confidentiality of whistleblowers must be strictly protected. Data protection plays a decisive role here: regardless of how the reporting system is designed, whistleblowers’ personal data is particularly sensitive and requires a high level of security. The compliance officer should therefore work closely with the data protection officer to develop a robust concept for protecting this sensitive data.

Responsibilities within the company

Responsibility for compliance usually lies with a dedicated compliance team led by a compliance officer. This person ensures that all relevant laws, regulations and policies are observed within the company. They are also generally responsible for implementing a compliance management system and suitable software solutions, such as digital whistleblowing systems. Although there are no statutory qualification requirements for compliance officers, many of these professionals have a legal or business background. In the organizational chart, the compliance officer typically reports directly to management.

By contrast, the data protection officer (DPO) acts more as an adviser. They review the state of data security within the company and make recommendations for improvement. The DPO focuses primarily on compliance with data protection laws. Although the DPO should be well connected, this role is often better suited to an external specialist—for example, an independent data protection expert.

Cooperation between the compliance officer and DPO

As the example of the whistleblowing system shows, data protection affects almost every area of a company and has a significant influence on its compliance structure. It is therefore essential that a conscientious compliance officer regularly consults with the data protection officer (DPO)—and vice versa. This cooperation offers numerous benefits:

·      Established data protection processes and methods, such as technical and organizational measures (TOMs), can also be applied in other compliance areas, including information security.

·      The compliance management system developed by the compliance officer can provide a valuable basis for creating a data protection management system, or even be fully integrated into it.

·      Strict data protection measures also help protect whistleblowers, which is a legal requirement under the Whistleblower Directive.

·      Training materials can be shared and supplemented by both sides.

·      Because compliance with data protection regulations is in the interests of both the compliance officer and the data protection officer, close cooperation is highly beneficial.

Data protection and compliance can be effectively interconnected. The key is for those responsible to identify and use the common interfaces within existing management systems. This creates legally compliant processes that are also visible externally. Companies gain sustainable competitive advantages: customers and prospects develop trust, while risks such as fines resulting from data breaches or regulatory violations are minimized.