A colleague asked me recently, “How do we convince CEOs to pay for privacy?” It’s a common question we get in the consulting space. The short answer is, there is no singular business case for privacy. Being a nuanced, contextual subject matter and one that leaders across sectors struggle to address consistently, the act of “selling” privacy is as audience-specific as many other compliance-related or advisory-based functions.

As a privacy person who has worked with a wide variety of organizations, each new privacy challenge reminds me of how much we can and should learn from security. Like an older sibling, security has its own tendencies, motivations, and mannerisms, and there is a critical opportunity for privacy, as the younger, to learn from our older, more experienced sibling. I say this as a little brother who should have learned more from his older siblings. In the spirit of continual improvement, let’s take that lesson and apply it to some of the many privacy challenges facing us today.

If there’s no universal business case for privacy, then how does privacy get funded? Successfully selling privacy work involves connecting privacy initiatives to core business objectives and organizational performance. While some businesses see privacy as a potential differentiator, or even a catalyst for diversified revenue generation, many still see privacy as a cost avoidance, compliance-related topic that garners only as much focus as is necessary to manage enterprise risk and keep regulators at bay.

Furthermore, different functional areas within enterprises have very different views of the relative importance, urgency, and potential impact of focusing on privacy best practices. For example, user experience leaders assess privacy regulatory obligations and risk differently than sales and marketing leaders, data infrastructure stewards, engineering heads, analytics managers, and even core risk and compliance professionals. So, if everyone has a different approach, and the only constant in privacy demand seems to be a lack of consistency, how can you positively develop and champion privacy engagements (either as an internal resource or an external supporter)? Here are some core areas to help you successfully pursue a successful privacy initiative:

So, how do we get CEO’s to pay for privacy? Well, CEO’s aren’t the only (or even primary) buyers of privacy support services. Making that assumption can severely lessen one’s ability to get a meaningful privacy initiative off the ground. Instead, you have to assess the organization, its risk posture, and the needs and demands of its leadership and customer bases. With this more complete view of the operating environment, you unlock a myriad of potential solutions that can be positioned in a manner more receptive to your audience and that actually possess the potential for long-term success and sustainability of your solution.

Many security teams started largely as standalone functions, tasked with magically achieving security for an entire organization. It’s a simple idea, really: Hire security professionals and they will take care of the problem. However, organizations have developed intriguing roadmaps for security, but failed to socialize those plans due to a lack of partnership and buy-in from functions across the business landscape.

Put another way, when you use this approach, everyone wins.

Thanks to Jennifer Chen and Jessica Traynor.