Legal and Regulatory Frameworks: Practical Obligations for Managers

Week 2 introduced the global landscape of data protection regulation and established the key principles of the GDPR and its equivalents around the world. This week’s treatment of legal and regulatory frameworks takes a different perspective: rather than describing the rules, it focuses on what compliance means in practice for managers making day-to-day decisions about data, people and processes.

There is an important distinction between legal compliance and genuine data protection. Legal compliance means meeting the minimum requirements of the applicable law. Genuine data protection means treating the people whose data you hold with respect, handling their information in ways they would reasonably expect and consent to, and taking the responsibility of data stewardship seriously as a professional obligation rather than a bureaucratic requirement. The most ethically sound position for a manager is to use legal compliance as a floor, not a ceiling.

What Compliance Means Day to Day

For mid-level managers, legal and regulatory obligations translate into a set of practical responsibilities that arise in the normal course of managing a team:

• Data minimisation in practice: the GDPR principle of data minimisation requires that only data genuinely necessary for a stated purpose is collected and held. For managers, this means regularly questioning whether the data your team collects and stores is all necessary for the purposes it was collected for. It means resisting the temptation to retain data beyond its useful life on the grounds that it might be useful in future. And it means understanding the retention periods that apply to different categories of data in your organisation and ensuring they are observed.
• Purpose limitation: personal data collected for one purpose cannot be used for a different purpose without fresh legal justification. For managers, this means understanding what data your team uses, why it was originally collected, and whether any proposed new use of that data is consistent with the original purpose. A customer database collected for service delivery cannot simply be repurposed for marketing without appropriate consent or other legal basis.
• Lawful processing: every instance of personal data processing must have a lawful basis. The six lawful bases under the GDPR are consent, contract, legal obligation, vital interests, public task and legitimate interests. Understanding which basis applies to your team’s data processing activities is not just a compliance requirement; it determines what rights individuals have over their data and what protections they are entitled to.
• Subject access requests: individuals have the right to request access to personal data held about them. When such a request is received, it must be handled within the regulatory timeframe (typically one month under GDPR) and must be complete, accurate and presented in an accessible format. Managers should know how to recognise a subject access request when one arrives and what to do with it.
• Breach notification: as established in Week 2, the GDPR requires organisations to notify their supervisory authority of qualifying data breaches within 72 hours of becoming aware of them. Managers are often the first to become aware that a breach has occurred, which makes their understanding of the notification obligation and their prompt escalation of suspected breaches to the appropriate function critical to regulatory compliance.

The Global Picture: Managing Across Jurisdictions

For managers whose organisations operate internationally or whose teams handle the data of individuals in multiple countries, the regulatory landscape is more complex. Different jurisdictions impose different requirements, and the penalties for non-compliance vary significantly. Several principles help navigate this complexity:

• The most protective standard as a default: organisations that operate globally often find it most practical to apply the most protective standard (typically the GDPR or its close equivalents) across all their operations rather than attempting to apply different standards in different jurisdictions. This approach reduces compliance complexity and minimises the risk of regulatory failure in stricter jurisdictions.
• Data localisation requirements: some jurisdictions, including Russia, China and India, impose requirements that personal data about their citizens is stored within their territorial boundaries. Managers overseeing data that crosses borders should understand whether data localisation requirements apply and whether their organisation’s data storage arrangements are compliant.
• Cross-border data transfers: the GDPR imposes specific restrictions on the transfer of personal data to countries outside the European Economic Area that do not provide an equivalent level of data protection. Organisations that transfer data globally need appropriate mechanisms in place, such as Standard Contractual Clauses, to legitimise those transfers. Managers who oversee international data flows should understand what mechanisms their organisation uses and whether they are current.
• Sector-specific obligations: beyond general data protection law, many sectors impose additional regulatory requirements that carry their own compliance obligations and penalties. Healthcare, financial services, critical infrastructure and education are all subject to sector-specific regulatory frameworks in most jurisdictions. Managers in regulated sectors should understand the specific obligations that apply to their team’s data processing activities.

The Consequences of Non-Compliance: More Than Just Fines

When the consequences of data protection non-compliance are discussed, the focus is often on financial penalties. The GDPR’s maximum fine of four per cent of global annual revenue or twenty million euros, and the increasing severity of equivalent penalties around the world, are significant and represent a genuine business risk. But the full picture of non-compliance consequences is considerably broader:

• Reputational damage that erodes customer trust and reduces competitive advantage, often persisting long after the regulatory matter is resolved
• Individual civil liability, as affected data subjects may be entitled to compensation for the distress caused by a breach of their data protection rights
• Regulatory investigation and audit, which is disruptive, resource-intensive and may surface other compliance issues beyond the initial incident
• Criminal liability in some jurisdictions, including for individual executives and managers in cases of serious or deliberate non-compliance
• Loss of the ability to process certain categories of data, which may significantly disrupt core business operations

For managers, the most important insight is that regulatory compliance is not primarily about avoiding penalties. It is about fulfilling a genuine obligation of responsibility to the people whose data you hold. Approaching compliance from the perspective of minimising legal exposure is likely to produce a different and less ethical outcome than approaching it from the perspective of treating data subjects with the respect their privacy rights entitle them to.