Data reform: turning regulatory change into better business decisions

Start with the decisions the business needs to make

On 5 February, most of the remaining data protection provisions of the Data (Use and Access) Act came into force. The ICO has confirmed that the requirement for organisations to have a complaints procedure is due to follow on 19 June, with some provisions concerning the regulator's governance following later. It has also updated guidance on data protection by design and default and subject access requests. ICO commencement statement (opens in a new tab)

For an executive committee, the useful starting point is the business decision affected by the reform. A product team may want to use customer information to improve a service. Operations may need a more reliable way to answer access requests. A growing firm may be deciding how much information to retain as it replaces manual processes with software.

Each decision needs a defined purpose, an accountable owner and a clear understanding of the effect on people. A broad instruction to review every policy can obscure those priorities. Leadership should ask which activities require a change now, which need further interpretation and which can continue under existing arrangements.

That assessment should produce a short, prioritised change plan. The plan should connect the applicable requirement to the affected process, the person responsible and the evidence needed to show that the change works. Legal interpretation becomes useful when the people operating the service know what to do differently.

Make sound decisions easier to repeat

Consider a proposed customer analytics initiative. The business case should explain the improvement sought, whose information is needed and whether the same result could be achieved with less data. The approval process should establish the applicable conditions for processing and how customers' interests will be protected. These are practical questions for a named decision owner to resolve with the appropriate specialists.

A reusable assessment can make that work more predictable. A familiar, lower-risk use of data should not require the same amount of review as a materially different use involving sensitive information or significant consequences for individuals. The route for escalation should be clear enough that staff do not have to guess which committee will accept the decision.

Proportionality still requires evidence. Record the purpose approved, the relevant constraints and the circumstances that would trigger another review. A change in supplier, data source or intended use may change the original assessment. Building those triggers into delivery routines helps a growing organisation avoid relying on the memory of a small number of experienced staff.

The commercial benefit is a more dependable process. Product teams can plan around known requirements, specialists spend their time on the decisions that need their judgement, and management can explain why a use of data was considered appropriate.

Connect privacy responsibilities to operational quality

A policy can describe how a request should be handled while the underlying records remain difficult to locate. An approval can be well documented while access permissions remain broader than intended. Leadership therefore needs to examine the connection between the decision and the systems that carry it out.

For a priority process, trace a small sample from intake through to completion. Establish where information is collected, who can use it, how inaccuracies are corrected and what happens when it is no longer needed. Where a supplier performs part of the process, include the supplier's hand-offs in that review.

Useful management information should expose friction and failure. Examples include requests returned for missing information, decisions repeatedly escalated for the same reason, unresolved data-quality issues and actions that remain open after an approved change. These measures can identify where clearer guidance or better system design would improve both service quality and control.

Avoid treating a falling number of escalations as success on its own. It could indicate greater clarity, or it could mean that staff have stopped asking. Pair volume measures with sample-based checks of the decisions themselves.

Give the next phase a business owner

An effective response over the coming weeks would select the most consequential processes, confirm the changes that apply and assign owners with the authority to implement them. The June complaints milestone should have a visible place in that plan, with enough time to test the customer journey before it becomes a live obligation.

Leadership should be able to answer three questions. Which customer or business outcomes will improve? Which decisions can teams now make with greater confidence? What evidence will demonstrate that the revised process protects people as well as supporting growth?

Those answers make data reform a manageable programme of operational improvement. They also give the executive committee a basis for judging whether the organisation is becoming more capable as its use of data expands.