In this episode I discuss what most organisations are getting wrong when it comes to establishing trust in their privacy practices. I provide insights into what it’s like as a DPO at tech companies on both sides of the due diligence battle. And I give tips on what you can do to beat the competition. Find out more at https://carlgottlieb.com.
(Published as a podcast)

Audio

Transcript

Hello and welcome back to the GDPR Guy. I’m Carl Gottlieb, your host and resident privacy advisor.

So, it’s been quite a while since I last did a podcast. About three and a half years I think. Life and work just kind of got in the way of producing any content, so here I am, back to give you my usual candid take on the privacy world and anything vaguely adjacent to it.

And while I remember, thank you to all you that have asked when I’ll finally get some new podcasts out. Here you go.

In this first episode back I thought I’d address one of the biggest issues in privacy that people rarely talk about – credibility. It’s all well and good actually being compliant, secure and an all-round A grade student at privacy, but if people don’t perceive that, then you’re dead in the water. Perception is reality. This goes for both the B2C and B2B world. If your buyer doesn’t trust you then be prepared for a world of pain, or worse, a lack of a job because no sales equals no wages.

Credibility is the name of the game here, because it cuts out so much friction in a buying process. Don’t know what to eat in Hong Kong before a 10 hour flight home? McDonalds might be the boring choice but you know it’ll likely be fine and it won’t lead to any toilet disasters on the plane home. Your pre-built established trust with the McDonald’s brand led you to an instant buying decision.

This is a B2C example, but in the B2B world, the more mature organisations out there that employ the likes of me will have procedures for performing due diligence on vendors, with rigorous procurement checks and legal intake processes. And the odd fact about all that friction in the buying process is that nobody wants to do it, not the customer that wants to buy the product, certainly not anyone on the vendor side, and not even the procurement vendor management and privacy people whose job it is to analyse the vendor. We hate that stuff. It’s important but we absolutely hate doing it.

And what are we really trying to get to? Trust. We want to establish some level of trust that you will be okay and won’t screw up with our data. And there’s two ways that work together to establish that credibility to generate trust – doing things right and not doing things wrong.

So let’s talk about the things that people are doing wrong. And I’m sorry that some of this will resonate with lots of you listening, as you will have done this yourself, but hopefully not for much longer.

Number One. Pretending to be a DPO. Yes, I know you’re the CEO, but telling me that you’re also the DPO tells me that in fact you don’t know much about the GDPR or what a DPO role is. A DPO can’t be conflicted by also having such a senior management position in charge of how data is processed. You should know that. If I ask if you’ve got a DPO and you don’t have one, just explain why not. Maybe you’re too small. That’s fine.

But equally, if it’s obvious you should have a DPO, like you’re a massive tech company, then you need a damn good reason why you don’t CURRENTLY have one. And even then, this is ringing alarm bells as it shows you don’t care about privacy, compliance or doing the right thing with customer data.

Number Two. Arrogantly mishandling questions. Another thing you occasionally see is the buyer privacy person ask the vendor an important and slightly complicated privacy question only to have a non-privacy person respond, again, usually a senior manager, sales person or founder, with a dismissive and brief response that in no-way answers the question properly.

A great example is if you ask the vendor a fair question such as, “Is user login information included within the scope of personal data in the DPA, such that you would be a data processor of it?” And they reply with, “We’re a business to business, software as a service provider, so the GDPR isn’t really meant to apply to people like us.”

Or the classic one, when you ask a vendor for their DPA to sign and they reply with, “What’s a DPA?”

I don’t care who you are or how small your company is, if you’re out talking to customers with a product to sell, you need to have the basics locked down, like having a DPA ready for customers to sign.

But if in doubt, just apologise, say you’re new to this privacy stuff, and that you have an expert on hand who can answer my questions.

Us privacy people will know if you’re trying to wing it. It just looks crap.

Number Three. What aren’t you saying? I’m a big believer in looking at what people are not saying, whether it be the press, politicians or a vendor. What they don’t say is usually more telling than what they do say. In the case of vendors, are they not bragging about all their other big customers? Are they not telling you about their security certifications? Sales is not a bashful world, and silence tells you a lot. They likely don’t have a good story to tell you. If they’re not wheeling out their privacy or legal people when you ask a tricky question then it’s likely they don’t have these people. And depending on the size of the organisation, not having some roles in place might be a red flag.

Similarly, in the tech world I live in, not having a SOC 2 report looks odd. Even the smallest pre-revenue stealth mode idea coming out of Y Combinator has a SOC 2. Somehow. And for larger tech companies, just get a Trust Page. You see these a lot now, basically a web page listing all the vendor’s security and privacy certifications and relevant policies. You can create this yourself easily, but vendors like Whistic, Vanta, Safebase and Drata do them brilliantly.

Not having a trust page isn’t a red flag by any means, but you really should have a webpage somewhere that says you at least know how to spell security. Work with your marketing people to show how much better your competitors are doing in this area. Trust pages are great because they remove friction before it ever happens. People trust a trust page.

Number Four. Too many people in the room. Another one to watch out for, and I’ve seen this several times, is during the procurement process, where one side has an outstanding question – usually a few remaining redlines in a DPA that need resolving. So you get a zoom call organised for both sides, and on one side you have one or two people from the customer and on the vendor side many times that, comprising of sales people, sales management, legal, privacy, outside counsel and any other interested party. I’m sure everyone has a good reason to be there. I’ve been on both sides of this, but it just looks weird. I’ve seen customers call this out as unacceptable and rightly so. It looks like you’re trying to intimidate the other side. And maybe you are. But it just serves to make you look bad.

Instead, for maximum credibility points, vendors should email the customer before the call and determine the exact nature of their questions, and then arrange a one-to-one call with the right counterpart, ideally a technical privacy person such as a DPO that can openly and honestly discuss the product and associated privacy matters. Customers will have more faith in what your privacy person tells them above anyone else. And if you haven’t got a privacy person readily available or you have but they can’t be trusted to talk product privacy to customers then you have wider problems to sort out first.

As far as doing things right, the biggest and best thing you can do is to go full disclosure. Get everything out there. Full transparency. Show the world you have nothing to hide, and explain exactly what your product does, how it works, how you comply with every regulation and provide an FAQ to every possible question the customer could ask. Anticipate what the annoying procurement person will want to know and answer it before they even think of asking it. Yes, you’d better have your house in order before you bare all, but believe me, this above anything else shows great credibility and often will stop that lengthy security questionnaire or that awkward zoom call to explain data flows.

Again, having a privacy person such as a DPO that works on both sides of the house is super helpful here. Someone that works on the back end assessing your vendors while also working with your customers’ assessments of you, knows all the tricks and all the difficult questions because they’re the ones asking and answering them. And the real super power is if you have a fractional DPO that works for similar organisations in your sector so they get even more exposure to how everyone is interrogating each other, and what strategies win.

Ultimately, the credibility game isn’t hard to win but it is easy to lose. You’ve just got to commit to getting your closet emptied of all the skeletons, get compliant, and then tell the world loud and proud how awesome you are.

Thanks for listening.

More Episodes of The GDPR Guy