At Legit, we have spent years working with companies across various industries to help them navigate the complexities of data privacy and compliance.
Through our experience and interactions with hundreds of organizations, and their DPOs, CISOs, and various other people in different roles, we have identified four distinct types of companies based on their approach to personal data.
Let’s explore these groups:
Predators
This group of companies builds their business models around monetizing and selling personal data.
This category includes industry giants like Meta, Amazon, and Alphabet, Chinese challengers such as TikTok, and specific companies who are supplying our personal data to intelligence agencies such as Clearview AI.
You can recognize these companies on our list of 20 largest GDPR fines so far and the staggering amounts of fines they have accumulated over the years.
These organizations accumulate substantial fines for data privacy violations, yet they continue operating as the penalties represent only a fraction of their revenues—a calculated cost in their business models.
Despite legal battles and regulatory scrutiny, these companies have no intention of changing their approach to personal data.
All those companies have large legal teams and strong external law offices supporting their complaints to fines, but the bottom line is that those fines, although in millions of euros, are just a small part of their revenues and the cost that is included in their business plans.
They will never change their business model and they will never respect personal data.
Sleepers
The second group of companies is the largest group and consists of companies that are unaware of or indifferent to data privacy regulations.
These organizations are often small to medium-sized businesses, or mostly in B2B or traditional industries, that lack a dedicated Data Protection Officer (DPO), and don’t know much about compliance regulations and GDPR.
They don’t even know where to start with their privacy program, mostly thinking they are not processing any personal data because they are not aware that employee data is also personal data.
Their wake-up call usually comes when they receive a data-related questionnaire from the regulatory agency or a requirement from a partner or a customer.
When this happens, some scramble to find a quick fix, while others take it as a catalyst to establish a proper privacy program.
Hopefuls
The third group consists of companies that have DPO and basic privacy compliance program, but privacy and data protection are not very high on the list of priorities.
Let’s be honest – as a board member of a large company, when approving next year’s budget, would you prioritize investing in new products, marketing strategies, management perks, or strengthening your resilience to data breaches?
In most cases, data privacy and data protection resilience programs come at the end of the priority list, because they are not necessary if you have paper-based compliance, you cannot make more revenue and profit with them and you cannot make management happier.
In such cases, investment in privacy program is either postponed for the next period or rejected, hoping that nothing serious will happen.
Why would hackers attack us and not someone else, who is bigger, more important, and has more sensitive personal data? We can call this “it will not happen to us” attitude —a risky assumption that can lead to severe financial and reputational damage.
However, the best and easiest target for attack is the one with the lowest level of protection, so if you are not well protected you must be aware that they are risking attack and paying for ransom or penalties much higher than the cost of investment for prevention and resilience.
Even after such incidents occur, companies in this group respond in two ways:
- Some adjust their approach and implement a proper privacy program,
- While others cling to the “it won’t happen to us again” mindset.
Leaders
The last and final group of companies are Leaders – companies that have implemented a robust privacy program, consistently invest in employee training, privacy automation, and governance.
They have well-defined processes and contracts for data sharing with third parties and take a serious, thorough approach to all aspects of personal data processing, including data removal.
In most cases, those are large companies in mature and regulated industries – banking, insurance, utilities, communications, and hospitality.
Such privacy program benefits not only the company but is also a requirement from partners and customers and a necessity for maintaining their reputation.
From privacy automation and governance perspective, they can be considered as early adopters of the technologies helping them run their privacy programs.
Unfortunately, the number of these leaders is still insignificant, and overall awareness of privacy challenges in the market remains relatively low.
It is obvious that, over time, more and more companies from Sleepers and Hopefuls groups will transition to Leaders – as a normal development of the maturing market, but from a current perspective it is hard to estimate how fast this change will happen.
Although the process of becoming mature in personal data processing is internal, three external factors play a significant role in shaping it:
- Requirements from customers and partners,
- Requirements and audits from regulatory bodies
- And threats from various hackers.
The Path Forward
Over time, more companies from the Sleepers and Hopefuls categories will transition into Leaders, driven by customer and partner demands, regulatory enforcement, and the growing threat of cyberattacks.
Software platforms such as Data Privacy Manager are already helping numerous companies worldwide to make that leap and streamline their privacy programs.
At Legit, we continue to support companies in navigating this journey, helping them achieve compliance efficiently while strengthening their overall data governance.
