Digital change, combined with the growth of malicious attacks, has pushed companies and public bodies to make data protection and, more broadly, data security a major issue.
This has translated into strong growth in recent years, also driven by the entry into force in 2018 of the General Data Protection Regulation (“GDPR”), in the roll-out of processes designed to frame and control, on an ongoing basis, practices relating to data processing and data security.
This strategic subject sits even more firmly at the heart of contractual relationships and inevitably has an impact on the discipline of contract management. Because of their central role in managing contracts, the contract manager will, whether they like it or not, be one of the architects of compliance with the commitments and objectives set in this area by the stakeholders.
This means they must understand the notion of “personal data” and the issues that go with it. That understanding is essential to guarantee contracts that comply with the regulations and align with the data governance rules in place.
What is the GDPR?
Without going into the detail of what the GDPR is, we can recall that it is a unified legal framework for the whole of the EU, aimed at strengthening individuals’ rights over their data and the accountability of those who process it. The GDPR rests on well-established and widely accepted key principles of privacy, such as purpose limitation, lawfulness, transparency, integrity and confidentiality. It imposes strict requirements on the collection, processing, storage, transfer and security of data.
For companies and public bodies, this means putting in place robust data protection policies and practices, particularly in view of what is at stake commercially and in terms of trust for these organisations.
In this context, the contract manager cannot fail to be directly involved in the management and protection of this sensitive data (personally identifiable information, financial data, intellectual and industrial property, and so on) in the projects they support.
The contract manager’s “DPO” reflex
We know (and we will be teaching no one anything here) that the contract manager wears many hats, a genuine Swiss army knife, and the subject of data is a perfect example.
Indeed, the security of sensitive data, once far from their concerns, is today unavoidable in contract management and administration. Rapid digital change, the consequences of cyberattacks and the risk of penalties all call for greater compliance and stronger guarantees on this subject in the contract. To live up to the essence of their role, the contract manager must therefore make sure that this parameter is properly taken on board by everyone involved and that the commitments made meet the requirements set.
To do so, they must be alert to and familiar with the main principles of the GDPR and with internal data governance, and be up to speed on best practice and on compliance assessment processes in this area. It also means adopting and implementing the reflexes of a data protection officer (or “DPO”) within their contract management methodology, and being proactive in their approach.
The contract manager as an asset
Whatever the sector or the size of the organisation, sooner or later you will inevitably face an incident affecting your organisation’s data and its business.
Faced with this risk, the contract manager can be a genuine asset and ambassador in meeting data security challenges and turning them into opportunities.
Indeed, they have all the skills needed to allow the organisation they work for to rise to these challenges. They can skilfully put forward and agree sufficient guarantees for each of the parties, and support the drafting of a clear contract that allocates responsibilities and obligations for security and for incident management.
Their flawless coordination, their negotiating ability and influence, together with their operational understanding, make this key role a natural fit and will be essential to the long-term success of this approach.
Conclusion
Current regulation, the growth of big data and the intensification of data breaches have brought significant change in the way companies and public bodies handle sensitive data. The economic consequences can be very serious and, beyond short-term financial losses, an organisation’s image may also be damaged for the long term. Data security is more than ever in the spotlight, and this strategic subject must be fully embedded by the contract manager. By taking on these responsibilities, they can help reduce the risk of non-compliance, strengthen stakeholder trust in the way sensitive data is managed, and maximise its value.