Andrew Bourne, Regional Manager - Africa, Zoho Corporation.

In the past, any company attempting to expand its clientele internationally faced challenges and barriers to entry. Today, we're well into the internet age, and managing logistics, like international freight and shipping, has become far easier. This has allowed even start-ups and SMBs to compete in the global market and develop a diverse clientele.

However, even though taking a business international has become more achievable, there are still some serious considerations that come into play for any organisation looking to do so. Among the biggest are the data protection and privacy implications that come with international expansion. Businesses run the danger of breaking regional laws and regulations when they don't provide data protection and privacy the care and attention they require. If hackers take advantage of those weaknesses, there's a bigger risk of having their operations disrupted as well as losing the confidence and support of their clients.

Regulatory and legal compliance is a start; not an endpoint

A good starting point is ensuring that both the business and its suppliers are compliant with various data privacy laws and regulations around the world. Businesses can’t assume that the laws and regulations only apply in markets where they have active operations either. The European Union’s General Data Protection Regulation (GDPR), for instance, applies to any company that has an EU citizen as a customer, regardless of where they currently live. Take a Cape Town-based company that only sells goods in its own city, for example, and assume one of their local customers is an EU national. The company has to be compliant with both South Africa’s Protection of Personal Information Act (POPIA) and the GDPR.

While the two regulations are broadly similar, it’s worth putting in the effort to be compliant with the privacy frameworks of all major markets. After all, the consequences for anyone found to be in contravention of data and privacy regulations are potentially severe. POPIA offences come with fines up to R10 million, or 10 years in jail. GDPR offences, meanwhile, carry fines of up to ₠20 million or 4% of total global turnover for the preceding fiscal year, whichever is higher.

Businesses should include privacy and security checks during due diligence processes for software vendors

Ensuring that businesses are as well-equipped as possible for data protection means practising proper database hygiene, utilising effective cybersecurity tools, and educating employees on why data protection and privacy practices are significant in the workplace. These things need to happen on an ongoing basis, with businesses adapting as new threats emerge.

One area of vulnerability that businesses often overlook is the software and productivity tools they use. It's critical that businesses use tools from companies that are not only compliant with the relevant regulations, but treat data protection and privacy as a business imperative. Aside from tools and offerings with robust privacy measures, vendors should present a business model that is not dependent on ad revenue and data monetisation. These proactive measures considerably reduce the chances of a data breach. With the average cost of a breach now at US$4.35-million, that’s an investment worth making.

Data protection is a business imperative, especially for those that go global

Taking your business global requires a higher level of accountability. Businesses of all sizes need to understand that they face many of the same types of challenges as major corporations, particularly when it comes to data security and privacy. As a result, they need to work hard and ensure that their customers are as well protected as possible, and that requires working with the right software providers.