Do workers really take data compliance seriously?

The reasons given for not complying with company security regulations are varied. In many instances, employees simply don’t know what the correct protocols are. Information management requirements are complicated, and some employees may not realise how they tangibly apply to their day-to-day work.

In other cases, the processes or tools they have to use are just too complicated to follow. A Harvard study⁴ found that 5% of tasks were deliberately completed in a non-compliant way. The top three reasons for offending were: ‘to better accomplish tasks for my job,’ ‘to get something I needed,’ and ‘to help others get their work done.’ These three responses accounted for 85% of cases. Breaking the rules was not malicious for the vast majority but motivated by a straightforward desire to get the job done.

Striking the right balance between responsible management and excessive interference is a major challenge for today’s IT leaders. Given the evidence, ITDMs are right to be concerned about employee behaviour, particularly outside of the office walls.

The ultimate goal should be to make managing information and data compliantly feel unobtrusive. In the first instance, this is about truly understanding employees’ requirements – something which is dramatically impacted by the industry and the role of each individual. ITDMs can reduce the likelihood of employees circumventing the company policies by speaking to lines of business about their workflows and understanding what policies are truly a necessity, and which create more trouble than they’re worth.

However, it’s also about creating an environment with more visibility and control. Interestingly, visibility of even common aspects of information management was a problem, according to the research. Only around half of IT leaders said they had capabilities in place to track how documents were being managed for audit purposes. For example, only 53% of IT leaders said they were able to track how documents had been shared. Without this visibility, it’s challenging for IT leaders to truly know whether employees are behaving compliantly.

The research reveals that many IT leaders are taking action. Respondents reported that they were beginning to implement digital document management to enforce automate best practice by automating how company information is managed. At a basic level, that includes implementing automatic access rights and automatic deletion of sensitive documents after a set period. For more digitally advanced organisations, that might be introducing workflow automation to ensure a full business process - such as invoice processing - has automation built into it, ensuring the process is controlled according to a set of pre-approved of steps.

But, there are also a large portion of ITDMs who admitted they haven’t yet introduced some of these more entry-level capabilities. In fact, even the most common functionality – automatic access rights to control who can access documents and locations – had only been adopted by 51% of those surveyed.

Secure, compliant management of business information is a top concern for every IT leader. But ensuring compliance is ultimately a challenge that centres around human behaviour. To set successful policies, IT leaders need to ensure they are neither obstructing employees, nor allowing them free reign to select how they manage information.

ITDMs should start by reviewing whether they have the right tools when it comes to visibility and control of how information is being used. With these in place, it removes the pressure on IT leaders to have eyes everywhere in an environment where manual tracking just isn’t feasible. Starting to build a more human-centred approach to compliance will help to avoid both accidental breaches and deliberate cases of non-compliance caused by labyrinthine measures. They’ll also help IT leaders to get a better night’s sleep.

Explore the IT Transformation Barometer here to get more insights on IT leaders' experience, from future procurement priorities to how they really feel about their role.