As more jurisdictional privacy regulations come online and compliance demands increase in complexity, operationalizing privacy programs require privacy professionals to have more skill than ever before. But what happens when there is a deficit of professionals able to meet the demand for top talent to fill vacant roles?

In response to growing workforce needs among customers, DataGrail launched a new managed services solution that contracts privacy management services for its clients. Services available through DataGrail's privacy management team include data subject requests and data mapping for organizations working to comply with the EU General Data Protection Regulation and comprehensive U.S. state privacy laws in California, Colorado and Virginia.

In her introduction to the new services, DataGrail Senior Director of Professional Services Brittany Hall said the program allows "customers to continue accessing the same reporting, auditing, and dashboard capabilities required to run a strategic program with the added bonus of a trusted partner to complete the bulk of day-to-day tasks."

Though managed services for data privacy are not new, DataGrail said they aim to differentiate their service by doing "the day-to-day work to run" a privacy program, "not just help get a customer up-and-running on our technology, offer them a representative to help them with high-touch support or offer educational courses." DataGrail likened their approach to that of the "managed security service providers industry," which leverages "outsourced security professionals who take on a large portion of the work to run a security program." For their new service, DataGrail said they "take on the day-to-day management, monitoring and reporting work associated with running a privacy program. Increasingly privacy is becoming more complex, so we believe this is a way to offer differentiated support to customers that need it." 

DataGrail CEO and Co-founder Daniel Barber anticipates more than 40% of DataGrail customers to seek out the new managed services feature.

"Businesses are still struggling today to find the right talent and also operationalize their privacy programs," Barber said. "DataGrail experts in the field of privacy will be powering and running the software itself on behalf of our customers. This gives teams the ability to offload some of the tactical ongoing work so they can up-level and focus on the strategy, goals and objectives of the privacy program."

According to DataGrail's Privacy Trends 2023 report, the total number of DSRs per one million identities increased 72% from 2021 to 2022. Following passage of the California Privacy Rights Act, 52% of DSRs came from states without a consumer privacy law. Barber said on a per-capital basis, citizens of Washington and Wisconsin submitted more DSRs than California residents.

The data "highlights the fact that businesses are not able to meet the demands of the market," Barber said. "What do you do if someone from Wisconsin requests their information be deleted? It's not required legally that a business needs to do that."

Barber said state-level privacy laws, such as the California Consumer Privacy Act and amendments brought by the CPRA, have effectively become de facto standards in other states. He added proactive companies in jurisdictions without consumer privacy laws ought to commit themselves to meeting California privacy regulations, regardless of whether they have a physical presence in the state.

Globally, he said, businesses that are perceived as weaker in terms of their customer privacy practices are at a competitive disadvantage, as consumers around the world demand more control over their personal data.

"It actually becomes less about a regulatory problem, and rather more of a risk and brand reputation issue. At the end of the day, the business is going to make a business decision on providing you the information you expect," Barber said.

Customers seeking the managed service offering will develop a mutually agreed upon workflow for the DataGrail team, which will adapt for each customer's needs. Monthly customer reports on data mapping or DSR activity will also be provided once customers contract with the managed services.

According to Barber, no customer data is ever transferred to a DataGrail database because its software works within a customer's personal cloud environment. The software has an "integration network" with more than 2,000 applications, including Salesforce, and automates the decided upon workflow. However, there is still a final review process where the DataGrail managed service team working on behalf of a contracted client will double check. For example, the team will monitor whether a specific deletion request is in keeping with the customer's workflow.  

Barber said managed services for customers will allow for a final layer of automation because the work agreements will empower the DataGrail team that works with the specific customer to take actions related to DSRs or data mapping, instead of going back to the customer's privacy team to make the ultimate call. 

"There's one (final) yard where someone has to review what is actually getting sent (in a DSR) and we're now even automating that as well," Barber said.