It’s no secret that compliance is a huge part of a corporate lawyer’s job. Whether it’s internal or external compliance, there’s a lot that needs to be done to keep a business operating smoothly and on the right side of the law.
While corporate compliance has always been a hot topic, the recent focus on how businesses collect and use personal data has created a new regulatory concern. The passage of several data privacy laws in the last few years—and the enforcement of those laws—has driven regulatory compliance to the forefront for companies that do business in the U.S. and abroad.
That shift began in 2018 when the European Union passed the General Data Protection Regulation (GDPR), which applies to all companies that collect and process data from people in the EU. Several jurisdictions have implemented their own GDPR-like laws since. The most impactful for U.S. businesses is the California Consumer Privacy Act (CCPA), which regulates how corporations can collect, use, and disclose the personal data of California residents.
Corporate counsel should pay careful attention to these laws and regulations even if the company’s primary business isn’t conducted abroad or in California. Why? Because these laws have considerable teeth, and regulators aren’t afraid to use them. In just the third quarter of 2021, fines levied under the GDPR totaled €984.47 million.
The CCPA also authorizes hefty fines for non-compliance with regulations related to customer data, including $7,500 for intentional violations, plus $100 to $750 per individual. These numbers might seem small at first glance, but for a company that collects the data of hundreds or thousands of customers, they add up quickly.
How do companies avoid these staggering regulatory compliance fines? By implementing a comprehensive and effective regulatory compliance strategy. In this blog post, I’ll explain the challenges of regulatory compliance and set out six easy steps you can follow to implement an effective strategy for managing regulatory compliance.
Contents
What is a regulatory compliance strategy?
What are the challenges of regulatory compliance?
6 Steps to implementing a regulatory compliance strategy
1. Determine your end goals
2. Identify what laws and regulations apply to the business
3. Draft clear policies and procedures
4. Train employees
5. Plan for internal audits and track violations
6. Keep data and documents organized
A comprehensive strategy can keep you in compliance
What is a regulatory compliance strategy?
A regulatory compliance strategy is the plan of action that a corporation follows to ensure compliance with state, federal, and international laws and regulations.
Usually, a regulatory compliance strategy is just one piece of a company’s overall compliance structure that also includes broader corporate compliance. An effective regulatory compliance strategy fits seamlessly under the larger compliance umbrella and complements the other compliance structures and strategies already in place.
What are the challenges of regulatory compliance?
Keeping up with all the ins and outs of regulatory compliance can be overwhelming, and designing and implementing an effective regulatory compliance strategy might seem daunting. Anticipating the challenges before crafting your regulatory compliance approach can make the process as smooth and painless as possible. There are two major challenges.
Regulations change constantly
Regulations are constantly changing, with new requirements coming into play and existing requirements being modified or extended. If there were only one jurisdiction to keep up with, that would be manageable—but businesses must maintain compliance with the regulations of every jurisdiction they operate in. That means that not only do corporate counsel need to understand the current federal regulations that apply to their business, but they must also be intimately familiar with the regulations in their home state, in states where they are serving customers or marketing to potential consumers, and even with international rules and regulations if they are participating in, or collecting data from, a global market.
Since regulations vary from industry to industry, each company will have a unique set of laws and regulations to analyze. As a result, no two regulatory compliance strategies will look exactly the same.
Noncompliance is expensive
The stakes are high when it comes to noncompliance. Fines can be enormous, seriously impacting a company’s profitability. But fines aren’t the only risk; noncompliance can also invite subsequent litigation and attendant costs and damages.
The notorious Equifax data breach from 2017 is an excellent example. In that case, the breach led to the exposure of over 147 million individuals’ sensitive information. Equifax has spent years negotiating fines and fees with the government and has agreed to pay as much as $700 million as part of a global settlement that included class-action lawsuits.
If that’s not enough, Equifax has also pledged $1.25 billion, to be spent over two years, to address the cyber-security weaknesses that led to the breach and to upgrade its analytics. This last cost is easily overlooked, but it makes sense that when a company violates a regulation, it must undergo costly restructuring to prevent future penalties.
While Equifax is a large corporation, these are still substantial numbers. Small and midsize businesses would be demolished by this type of noncompliance. Fortunately, a comprehensive compliance strategy can head off most compliance issues.
6 Steps to implementing a regulatory compliance strategy
1. Determine your goals
To create an effective compliance strategy, you need to figure out your end goal. In the case of regulatory compliance, the goal might be to reduce or eliminate regulatory compliance fines. Alternatively, you might focus on increasing employee awareness about regulations or allocate resources toward compliance with a particular law or regulation that has been a headache in the past.
2. Identify what laws and regulations apply to the business
Compliance depends on identifying all of the laws and regulations that apply to your business. This might seem basic, but it can be a bit more complicated than it sounds. That’s because small and midsize legal departments may find their resources stretched as they attempt to identify and stay current on every change in their regulatory landscape while also dealing with all of their other responsibilities.
Invest the time to thoroughly identify and organize all of the relevant regulations that affect the company and assign a lawyer the recurring task of monitoring for changes in the law. By organizing all of your requirements in an easy-to-digest manner, you can easily refer back to them whenever there are changes.
3. Draft clear policies and procedures
Well-drafted policies and procedures are one of the most important parts of any compliance strategy. After all, a legal department cannot expect every employee to understand the law, let alone appreciate the steps required for compliance.
Create clear rules that can help to keep each employee and department—and ultimately the company—out of regulatory hot water. While the legal department should craft the company’s policies and procedures, don’t forget to collaborate with other departments to gain input on how your proposed measures will practically affect the company and its employees.
4. Train employees
Once you have policies and procedures, you’ll need to build an effective training program for employees. Employee training might vary from department to department or even employee to employee. This detailed planning and training might seem tedious, but it’s important to think carefully about how to train employees, as the success of your compliance strategy depends on them.
Remember that at the end of the day, the company—not the employee—bears the consequences of regulatory noncompliance. Instead of rushing through training in one block, try to create an incremental training schedule that includes hypotheticals and hands-on activities to ensure maximum retention and effectiveness.
5. Plan for internal audits and track violations
You don’t want to wait until you’re hit with a fine to discover the holes in your compliance strategy. Instead, plan for regular internal audits to ensure that your policies and procedures—and your training program—are resulting in compliance at every step along the way. This internal audit will likely encompass a review of your compliance goals and policies as well as analysis of individual employee and departmental stats.
An internal audit can reveal the weaknesses in your compliance strategy and give you an opportunity to fix them. Perhaps you’ll discover that an employee or department needs additional training or a specific policy isn’t quite as effective as it should be. Whatever the flaws, a regular internal audit can save your company from serious consequences down the line.
If you do get hit with a violation, keep track of the details each time. This information is important for identifying reoccurring fines and the internal costs associated with them. With that information, the legal department can further fine-tune its compliance strategy.
6. Keep data and documents organized
Since data is at the heart of many regulations, like the CCPA and GDPR, it is important to map your organization’s data and keep it organized.
Data mapping includes looking at how data is collected, who it is collected from, how it is stored, and how it is used or shared. Businesses should also assess their documents, including their policies surrounding data collection and retention and how those policies are communicated to customers.
A comprehensive strategy can keep you in compliance
With a bit of helpful information and a well-planned strategy, you can create a plan to help your company continue to turn a profit instead of getting bogged down in regulatory fines.
[View source.]
