Why it’s so important to safeguard your customer data and protect your brand

The personal information of consumers is the new oil of the digital world. Everything runs on data. But while the businesses that collect and process consumer data have become increasingly valuable and powerful, recent events prove that even the world’s biggest brands are vulnerable when they violate their customers’ trust.  

It’s a lesson Canadian businesses should take seriously. With the federal government investing heavily in digital innovation, Canada’s tech sector is thriving and we should expect to see more homegrown success stories like Shopify soon. As our economy undergoes a digital transformation, it’s important that Canada’s business leaders strategize not to simply compete with Silicon Valley, but to distinguish themselves in the areas of consumer privacy and data security – this could, in many ways, become the new Canadian competitive advantage in a global digital economy.  

Consumers, for the most part, know that businesses use their information to deliver more personalized products and services and are largely accepting of the practice as long as it makes their lives a little easier (local weather and traffic alerts, song recommendations on Spotify, etc.). However, this agreement quickly breaks down when trust is compromised.    

Without the proper checks and balances in place to safeguard customer data, things can go sideways quickly. Forfeiting billions in market value, squandering brand reputation, being hauled in front of industry regulators and even the courts — every crisis scenario in the communications handbook is on the table if your business does not perform its due diligence to protect customer information.  

Take a proactive approach to data protection

Governments around the world are rolling out new regulations on how customer data can be collected, used and stored. Coming into effect this month, Europe’s General Data Protection Regulation (GDPR) will allow EU consumers to pull their data from a company at any time. Canada’s long-awaited Mandatory Data Breach Notification requirement will come into force on Nov. 1, requiring organizations that experience a data breach to report the incident to the Privacy Commissioner of Canada and to notify affected individuals when there’s a “real risk of significant harm to the individual.”

These new legal and regulatory requirements will only intensify the spotlight on how Canadian organizations are handling — or mishandling — customer data, so time is of the essence for businesses that still have not implemented a diligence process.

Your words will hold no weight if your customer data falls into the wrong hands and your organization took no prior measures to protect it. Exercising due diligence today will not only better protect your customer data, it will make sure the impact to your business, from both a legal and brand-reputation perspective, is mitigated if and when disaster strikes.

Know who you’re doing business with

With high-profile breaches seemingly in the news every day, “protecting yourself from hackers” has traditionally dominated the data privacy conversation. However, this is a bit like installing a top-of-the-line home alarm system and then inviting a stranger over for dinner.

If you’re transferring private customer information to a third party for any reason, the onus remains on you to keep it safe. Even if you trust your partners and vendors, you must “trust, but verify” because if anything goes wrong, recent events highlight how it will always be the larger, more well-known business that’s left holding the bag. Your customers will say, “I don’t even know who this other company is, but I had a relationship with you. I trusted you.”

In a competitive business environment, you’re always going to be enticed when a new vendor offers a solution that promises to cut your costs in half, improve customer experience or provide new insights, but if you’ve never heard of the company, you need to do a background check, ask for referrals and, in some cases, even audit their physical office location.    

Get more than a signature  

Every day, lawyers review contracts between companies and vendors that clearly outline the proper use of consumer data. “You will do this … you will do that … you shall destroy the information once you no longer need it.” The language is all there. Signed and contractually binding.

But what is the value of all this paper? Considering that most indemnity clauses are capped, if your vendor mishandles or exposes your customer data, will you ever receive true value for the damage to your business’ reputation? It’s unlikely.

When Canada’s privacy commissioner comes knocking, what are you going to say? It’s not enough to say you had a contract in place. Legally, your organization is still on the hook if you don’t follow up. To protect your business, you need to invest significant time and effort ensuring your vendors are keeping their promises, regularly auditing and verifying that they are effectively safeguarding your customer data.

Protect your brand

When preparing for the worst, businesses should develop a communications strategy that works in conjunction with its IT-response plan. Otherwise, you risk a disjointed, inconsistent and delayed response to issues or crises. It is also imperative to align how your organization will communicate with stakeholders. This will reduce the need for real-time decision-making in an actual crisis, as well as help limit inappropriate responses. Finally, practice makes perfect. Running a cybersecurity crisis simulation will help you identify flaws and gaps in your process, and better prepare your teams for such a pressure-cooker situation when it hits.  

Remember, however — if you suffer a data loss, your customers don’t just want to hear what you’re going to do from this point forward, they want to know what you’ve done already. If the worst happens, you need to communicate in a way that demonstrates you have taken every possible step to keep your customers’ information safe.

Losing data is easier to recover from than losing your customers’ trust. Doing your due diligence will not only help protect your data, it might just save your brand one day.

• Angela Carmichael is president of FleishmanHillard HighRoad and specializes in corporate reputation. Imran Ahmad is a partner at Miller Thomson LLP, specializing in cybersecurity law and is the author of Cybersecurity in Canada: A guide to best practices, planning and management.