On the 25th of May 2018 the General Data Protection Regulation (GDPR) came into effect. This new privacy law has increased the amount of control European Union citizens have over their personal data. Customer data has become of strategic importance to companies, as personal data is valuable across different business operations, such as forecasting, inventory management, differentiating products and offering personalized products (Chellappa & Sin, 2005).

The GDPR requires businesses to change the way they collect, store and process personal data. GDPR compliance costs are high according to business reports; the International Association of Privacy Professionals (IAPP) released a report which indicated that companies who employed IAPP professionals spent an average of 1.3 million dollars in 2018 on GDPR compliance (IAPP-EY, 2019). You can understand that businesses are not too happy about the GDPR, as it costs time and money. However, it is important to look a little further than such business reports.

For starters, increased customer privacy control is suggested to increase the likelihood consumers click ads. Tucker (2014) did a randomized field experiment among 1.2 million Facebook users in which ads were twice as effective after Facebook had updated their privacy policy which gave users control over their privacy. Culnan and Armstrong (1999) found that disclosing fair information practices can lure a customer into acting against their privacy concerns. These studies may have taken place before the GDPR ever existed, but they are very relevant as the GDPR requires companies to adopt fair information practices, disclose those to consumers and generally give consumers increased control over their privacy. Studies suggest consumers’ purchase likelihood might increases as a result of the practices companies adopt due to the GDPR.

Additionally, the process of becoming GDPR compliant forces companies to revisit all data processes that include personal data. Revisiting processes will likely lead to improving those processes. This may help the company perform better and thereby cut costs. Also, it would make sense for companies to investments into better data management systems as a result of the GDPR, which will also help companies across operations.

Besides better data processes and better data management systems, data itself will also be better as a consequence of the GDPR. The GDPR allows consumers to rectify their data, which will result in more accurate data which in turn will lead to better forecasts. Also, customers now give their consent before data is collected which means companies will send marketing messages to interested customers only. Now that’s a great way to save money!

Besides the increased costs companies experience in becoming and remaining GDPR compliant, there are different merits to the improved privacy policy. The coming years will tell whether the GDPR has had a lasting effect onto companies or whether companies simply had to adjust. For sure, the last word has not been said yet about the regulation. On that note, tell me what you think!

References:

Chellappa, R. K., & Sin, R. G. (2005). Personalization versus Privacy: An Empirical Examination of the Online Consumer’s Dilemma. Information Technology and Management, 6(2-3), 181–202.doi:10.1007/s10799-005-5879-y

Culnan, M. J., & Armstrong, P. K. (1999). Information Privacy Concerns, Procedural Fairness, and Impersonal Trust: An Empirical Investigation. Organization Science, 10(1), 104–115.doi:10.1287/orsc.10.1.104

IAPP-EY. (2019). IAPP-EY Annual Privacy Governance Report 2018. Retrieved from: https://iapp.org/media/pdf/resource_center/IAPP-EY-Gov_Report_2018-FINAL.pdf

Tucker, C.E. (2014). Social Networks, Personalized Advertising, and Privacy Controls. Journal of Marketing Research, Vol. 51, No. 5 (October 2014), pp. 546-562