Michael Ogbu

Across different projects, I’ve witnessed firsthand how teams can go from being extremely regulatory conscious to becoming completely complacent. In most cases, the expectations are clearly outlined and the rules well spelt out at the onset.

And as the project kicks off, everyone is seen to be in full compliance until the realities of the job begin to kick in. The pressure of meeting set targets, the anxiety that comes with dealing with exigencies, the desire to get things done – and done quickly – and gradually, the steam begins to wane.

By this point, team members begin adjusting to what they consider the best means of meeting expectations. But sometimes, those adjustments come at a cost. Privacy and confidentiality requirements begin to get circumvented, shortcuts become normalized, and practices that would ordinarily have raised concerns start to feel like “just the way we do things.”

The truth is, there’s hardly ever a team that sets out to fail or falter. Neither are there many organizations that deliberately set out to flaunt the rules. The bad practices and breaches we often hear about are rarely the result of a complete absence of regulatory knowledge.

More often, they occur because of poor and unsustainable implementation systems. This is why effective leadership, and enforceable systems cannot be overemphasized. Because it’s one thing to have a good understanding of regulatory requirements. It’s another thing to apply them consistently, even when nobody is watching.

Regulatory consciousness means that the rules, policies and strategies established by an organization are not only clearly communicated and understood across its various levels but are also consistently reflected in everyday decisions and practices.

And this is important for far more than simply keeping the organization on the right side of the law. Regulatory consciousness serves as a crucial operational tool that can:

• Boost organizational reputation by demonstrating that the organization takes its responsibilities seriously.
• Streamline cross-functional SOPs by establishing consistent expectations across teams.
• Improve decision-making by ensuring that regulatory considerations are incorporated before decisions are made.
• Minimize risks by identifying and addressing weaknesses before they become incidents.
• Enhance data management and security by reinforcing responsible handling of information throughout its lifecycle.

In other words, compliance can create operational value. It can help organizations make better decisions, protect their information assets, build trust and establish greater consistency across teams. This is particularly important as organizations increasingly operate in environments where personal information moves across systems, departments, vendors, technologies and jurisdictions.

However, embedding an effective regulatory-conscious culture across teams isn’t a walk in the park. It takes strategy. It takes implementation. And, most importantly, it takes consistency.

An organization cannot conduct a two-hour privacy training during onboarding and assume that regulatory consciousness has been established. People need context. They need reinforcement. They need to understand not only what the rules are, but why they matter and how those rules apply to the situations they encounter every day.

For me, there are several practical ways organizations can begin to embed regulatory consciousness across teams.

1. Align metrics and accountability with privacy goals
Organizations communicate their priorities through what they measure and reward. If employees are consistently measured on speed, volume and output, while privacy is treated as a secondary consideration, it shouldn’t be surprising when people prioritize speed over compliance under pressure. Privacy expectations need to be reflected in performance measures, accountability structures and leadership decisions. What gets measured often gets attention.

2. Embed privacy by design
Privacy should not be something that is considered after a process, product or system has already been developed. It should be considered from the beginning. Whether designing a new workflow, introducing a new technology, collecting personal information or changing an existing process, privacy considerations should form part of the design conversation. The earlier privacy enters the room, the fewer expensive corrections are likely to be required later.

3. Move learning from static to contextual
There is value in formal training. But people don’t always remember a regulation simply because they were shown a slide about it six months ago. Learning becomes more meaningful when it is connected to the actual situations people encounter. What should an employee do when a colleague requests information they may not be authorized to access? What happens when a system fails and the usual process is no longer available? What should someone consider before sharing personal information with a third-party tool? These are the moments where regulatory consciousness is built.

4. Encourage agency through privacy champions and a speak-up culture
People need to feel empowered to raise concerns before they become incidents. A network of privacy champions across teams can help bring privacy conversations closer to the people actually performing the work. But champions alone are not enough. There must also be a culture where employees can say: “I’m not sure this is right” without fearing that they will be perceived as obstructive or difficult. Sometimes the person who slows down a process for five minutes is the person who prevents a much bigger problem six months later.

As a key component of the RITE Framework, Regulatory Consciousness is ultimately about helping organizations move beyond a checkbox mentality. Being on the right side of the law will always matter, but privacy practice should not end there.

Organizations should recognize privacy for what it increasingly is: a business function. It influences how organizations design processes, manage information, deploy technology, communicate with customers, manage risk, train employees and make decisions. And like every other important business function, it requires leadership, resources, accountability and continuous reinforcement. Because compliance is not sustained by policies sitting in a document repository. It is sustained by people. And leadership, systems and organizational culture determine, to a great extent, whether those policies remain words on paper, or become part of how an organization actually operates.