Build A Case for Privacy Incident Management

From one company to the next, privacy leaders are spread out across organizational reporting structures. Since reporting structures vary, privacy leaders often need to talk to people outside their department to make a case to prioritize data protection and privacy compliance. To help build a case to prioritize privacy at your organization, experts Abby Martinez, privacy officer at Walgreens, and Erik Rahman, privacy director, HCSC have detailed their strategies for selling Radar Privacy internally to build a case for privacy incident management.

Through their experiences, we hope to provide valuable insights into effectively advocating for this crucial aspect of data protection within your organization.

Benefits of Technology

Prior to adopting a dedicated privacy management solution, both Erik and Abby described heavily manual processes that relied on offline risk assessments and ad hoc notification operations.

For example, HCSC had an existing incident management solution, however it lacked risk assessment and notification analysis. When incidents arose, a committee submitted written assessments and would use spreadsheets to make notification decisions. This process involved a lot of paperwork, manual data entry, and lacked consistency, proving to be quite time-consuming.

Similarly, before partnering with RadarFirst, Abby’s organization used a central incident management system that wasn’t built specifically for privacy compliance. In her case, detailing the nuance of why a “one size fits all” case management solution was suboptimal for their needs.

Identify, Understand, and Anticipate Concerns

A key aspect of building a successful case for a privacy management solution involves understanding the concerns of decision-makers and addressing them proactively.

Abby emphasized the importance of anticipating questions and concerns from stakeholders, particularly, understanding and anticipating how their needs may be different from her teams’.

“We didn’t want to assume that decision-makers knew what our team did. So we planned to provide some education for them, thinking about what do they need to know about what we do? We wanted them to be clear on the steps of the processes our team carries out to fulfill our obligations.” -Abby Martinez

When presenting their business proposal, Erik and Abby highlighted several key features and benefits of RadarFirst that resonated with stakeholders:

Reduced risk: The standardized assessment criteria, automated workflows, and up-to-date legal library offered by Radar Privacy ensure consistent risk assessments and accurate notifications. This consistency of systematically determining reportability of incidents reduces the risk of errors and inconsistencies that can arise from manual processes.

“It was helpful for our decision-makers to see the assessment portion in action. I think it helped them realize just how complicated the assessment process can be and especially them having that understanding as to what our current process was at the time, how we were conducting our assessments versus what the platform had to offer.” -Abby Martinez

“I think it helped them realize just how complicated the assessment process can be and especially them having that understanding as to what our current process was at the time, how we were conducting our assessments versus what the platform had to offer.” -Abby Martinez

Time savings: Automating many aspects of privacy management, such as risk assessments, notification determinations, and reporting, frees up valuable time for privacy teams to focus on other priorities.

Return on investment (ROI): The time savings and reduced risk translate to tangible cost savings, making a strong financial case for the investment.

Improved Collaboration: Erik highlighted how Radar Privacy improved collaboration between the privacy office and leaders in other departments. With a centralized system for managing incidents, the team established better communication and a more cohesive approach to privacy management.

Long-term Value

Beyond the immediate benefits, both Erik and Abby emphasized the value of the ongoing partnership with RadarFirst. Abby highlighted RadarFirst’s responsiveness to feedback and willingness to incorporate user suggestions into platform improvements. Erik shared how their relationship with RadarFirst evolved into a collaborative partnership where they could discuss new challenges and explore solutions together.

This collaborative approach extended to developing new features within Radar Privacy, like the CSV import functionality that addressed their need for a centralized incident management system.

The experiences shared by Erik and Abby provide valuable insights for building a case for investing in a privacy management solution like RadarFirst. By focusing on reducing risk, saving time, demonstrating ROI, and highlighting the benefits of a strong partnership, privacy experts can effectively advocate for the resources needed to implement a robust privacy program.