Making Sense of Regulatory Changes in a Global Economy

Privacy and cybersecurity developments around the world are evolving at a rapid pace. To safeguard national interests and security, governments are under pressure to respond to ever-growing concerns around data. These pressures have resulted in country-specific regulations, some of which conflict across various global jurisdictions. Regulations such as the US State of California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), EU General Data Protection Regulation (GDPR), EU Artificial Intelligence Act (AI Act), and India’s Digital Personal Data Protection (DPDP) Act have distinct objectives, driven by each region’s values and economies.

This can create conflict for organizations that operate in different countries or engage with third-party vendors outside of their country of origin. Even if an organization has not conducted business with a given country directly, certain regulations can influence compliance obligations. For example, an organization could be subject to compliance with cross-border regulatory requirements if it has engaged with a vendor in another country.

Navigating such dynamics is not merely a matter of ensuring that legal safeguards are in place. It is about creating all-encompassing compliance programs based on comprehensive global standards.

Technology risk and governance professionals must identify the core of global regulations and their impact (figure 1) to manage and maintain their organization’s operational risk posture. Strategic guidance from an organization’s leaders will play a key part in adapting to the evolving regulatory landscape.

Figure 1—Comparison of Regulatory Frameworks

Navigating Regulatory Complexities

As organizations expand their operations across nations, they are continuously challenged to ensure compliance with both local and international regulations. The pressures are not just legal; mismanagement can lead to reputational damage and operational inefficiencies. There are four dimensions that may shape an organization’s compliance strategies:.

1. Global and local regulations—Currently, organizations encounter compliance issues with global and local laws due to operational activities occurring in multijurisdictional regions. Such organizations must follow local regulations in addition to the global control framework requirements.
2. Reputation—To lower the cost of compliance, organizations sometimes establish their headquarters in regions with lower regulatory requirements for operations, which can lead to unintended reputational damage. For example, TikTok, owned by China-based ByteDance, was questioned over its data handling practices, namely, allegedly storing data in less-reputed regions. This raised some serious reputational and trust issues, specifically with the US government.⁵
3. Governance—Organizations can leverage internal or independent risk assessments along with other related compliance programs to manage multiple regulatory requirements, thereby eliminating duplication of efforts.
4. Automation—AI and machine learning (ML) technologies can be used to track privacy and law changes to ensure an organization’s regulatory readiness. AI and ML can also be leveraged to automate responses and keep track of compliance activities across different regions.

Managing the Emerging Regulatory Landscape

As the regulatory landscape continues to evolve, organizations will benefit from a structured and proactive approach to managing compliance risk. This will enable them to build resilient compliance programs that not only meet regulatory requirements but also enhance overall operational efficiency and trust.

Monitor Regulatory Changes
Subject matter experts (SMEs) should regularly monitor regulatory changes, updates to legislation, and emerging trends within the privacy and cybersecurity space. Organizations can also consider creating functions or teams to engage with regulators, policymakers, and industry experts to stay informed about regulatory changes. This could provide opportunities to offer input on laws that are in development. Such engagements offer an organization an edge by promoting compliance with global regulations, thereby strengthening its overall reputation in the marketplace.

Perform Risk Assessments and Mitigation
Performing periodic risk assessments against regulatory changes helps identify risk, reduces the likelihood of it materializing, and lessens its potential impact on customers, products, or services. Organizations can then develop and execute mitigation strategies to address the identified gaps. Such assessments also instill confidence in regulators and auditors that the enterprise cares about its consumers.

Embrace Documentation and Training
Policies and procedures should be documented to accommodate regulatory changes and industry best practices. Risk assessments can provide signals for the policy update process. Additionally, mandatory training and awareness programs such as annual privacy and security training, as well as third-party engagement training, must be assigned to employees and contractors to ensure that they are aware of their responsibilities to establish sustainable compliance across the organization.

Utilize Technology
Leveraging in-house or third-party governance, risk, and compliance (GRC) solutions can streamline overall compliance. These solutions provide services such as regulatory monitoring, policy and control management, risk assessment, audit reporting, and incident management. Implementation of such solutions can improve efficiency by reducing manual work and ensuring near real-time tracking of regulatory changes, aiding in identification and remediation of compliance gaps before they escalate. This helps avoid penalties and reputational issues, ensuring audit readiness through logging and evidence management. These efforts can be scaled over time to enable compliance across regions. Enterprises can also use data analytics to monitor and build compliance baselines that aid in developing the right risk and performance indicators for leadership. This will help identify opportunities for improvement and inform risk-based decision making.

Adopt Continuous Monitoring
Organizations must regularly review their compliance programs to verify whether all applicable regulations are covered, implemented controls are effective, and required mandatory trainings are up to date. They should also assess audit findings, third-party compliance, and how well the program is supporting organizational and compliance goals. These insights can help prioritize program updates and ensure alignment with the evolving regulatory landscape. Potential findings from such program reviews may include repeated failed controls, underestimated third-party risk, or a lagging response to new regulations. These warrant stronger cross-functional collaboration between compliance teams, process automation for risk signal sharing—upstream and downstream—and proactive regulatory tracking to maintain long-term compliance and agility.

Proposed Organizational Structure

The proposed organizational structure provided in figure 2 can help organizations manage regulatory updates more consistently. When clear roles are defined, regulatory changes are monitored, reviewed, and implemented in a timely manner across the organization. This can ultimately reduce risk, improve governance, and ensure timely communication and training, thereby moving the organization from operating with a reactive mindset to a more governed process that supports enterprise growth.

Executive Sponsor
An executive sponsor, such as a chief risk officer or a chief control officer, provides strategic oversight and resources as needed to implement changes across the organization to manage regulatory expectations. The executive sponsor aims to ensure that organizations are globally compliant and guides the team when a critical risk or other issue is identified. For example, consider a new EU cross-border data transfer regulation that requires organizations to make big changes to data handling procedures, encryption standards, and third-party contracts. This would be communicated by a regulatory change committee to product, engineering, and legal teams who may not align on implementation timelines. Organizations may be resistant to such a change because of the operational impact it would have due to lacking resources. In such a scenario, the executive sponsor would step in and escalate the matter to the executive leadership team, requesting resources and creating a cross-functional team to align on priorities to meet regulatory deadlines. They would further emphasize the importance of adhering to such compliance requirements to avoid regulatory fines, reputational damage, or data processing restrictions.

Regulatory Change Committee
This team operates cross-functionally across the organization and checks for regulatory developments around the globe, defines priorities, aligns resources, and provides strategic guidance in the decision-making process. Its primary role is to make sure all regulatory changes are addressed across business units operating in different regions.

Regulatory Change Management Office
This team acts as a central coordination hub, tracking all regulatory change requirements, performing impact analyses, overseeing project execution, and reporting to leadership. This ensures that a process is in place for effective change management.

Regional Leads
This group tracks any regulatory changes within regions. It will then review and interpret the new requirements for applicability. Regulatory changes are communicated with the regulatory change management office to ensure that the organization’s strategy is aligned to meet new local requirements. The regional leads function as a glue between global leadership and regional operations teams.

SMEs
Subject matter experts (SMEs) bring deep expertise to each compliance area. They work in conjunction with regional leads to review requirements, propose how to respond to new or changing regulations (e.g., via updated processes, systems, or controls) and work with product/service, engineering, or risk and compliance teams to implement processes, policies, or systems.

Training and Communications Team
This group creates training and communication offerings so that all employees in the organization are aware of pertinent regulations. The team supports the emerging regulatory landscape by developing scenario-based e-learning modules, role-specific modules (e.g., secure coding practices), and live webinars tailored to new compliance requirements. They can also launch enterprise-wide communications such as monthly bulletins on the enterprise’s position on certain regulations, policy change announcements, and FAQ pages to promote awareness across the organization. For major changes, this team may launch internal campaigns and further provide manager toolkits to drive adoption.

The matrix in figure 3 outlines who is responsible, accountable, consulted, and informed (RACI) across key activities in managing or supporting regulatory changes. This can help reduce ambiguity, drive cross-functional coordination, and ensure timely execution to meet regulatory requirements.

Figure 3—RACI Matrix for Global Regulatory Change Management

Global Harmonization for Regulatory Changes

Global harmonization to manage regulatory changes is aspirational but remains a very distant goal. Many countries are economically dependent on each other, which leads to a flow of data across regions. However, regulatory frameworks still do not aim to help harmonize these data flows. The EU GDPR prioritizes data transfer and data subject rights, while the California CCPA/CPRA tries to balance privacy while pushing for innovation and commercialization. India’s DPDP, meanwhile, reflects distinct policy and governance objectives with a data sovereignty approach.

The deviations in these regulatory frameworks are not only technical in nature but also reflect economic, social, political, and cultural differences. To achieve harmonization, it would be necessary to reconcile value systems across countries—a fundamental change.

Global regulatory harmonization would provide organizations with an opportunity to streamline compliance (and be less of a blocker for business) by reducing the complexities involved across each regulatory framework. This would help organizations achieve higher operational efficiency when it comes to service or product development, cross-border data transfer, and third-party risk management.

Harmonization would also strengthen trust among customers as it demonstrates a unified approach to adhere to privacy and security. Additionally, it would allow any organization, from small to medium startups to a global enterprise, to scale without having to manage different regulatory requirements. Moreover, if global regulatory bodies align, it would enable the sharing of best practices, which may help organizations react swiftly to emerging threats around cybersecurity or AI.

On the other hand, despite the benefits of harmonization, there could be several challenges. One immediate concern is that having a standardized approach may fail to address country- or region-specific risk. Also, smaller organizations or startups might find it too expensive to adapt to unified standards that would be more suitable for larger enterprises.

Harmonizing frameworks could also prove challenging to a regulator trying to enforce region-specific requirements to address national concerns.

In the United States, for example, regulations differ by state. A potential approach an organization could take would be to first adopt the most comprehensive standard by aligning its policies with the state that had the most stringent law—for example, the US State of California’s CPRA. This could reduce the complexity for the organization to adopt any future legislation and improve its compliance readiness. The organization could then create one enterprise-wide governance framework to map state-specific regulatory requirements to controls using standards such as those from the US National Institute of Standards and Technology (NIST) or International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27001.⁶

Emerging technology sectors such as AI governance and cybersecurity have attempted to standardize technical control requirements. However, legal harmonization remains on the distant horizon. Until there is some alignment on legal harmonization, organizations must follow a risk-based approach.

Enterprises must focus on basic principles, be transparent, and identify accountable parties to be prepared in navigating a dynamic regulatory environment. Global risk assessments and a strong data governance practice demand investment to manage regulatory agility.

Conclusion

Compliance is more than a checkbox item—it is a means of competitive advantage in the global marketplace. Regulations such as the CCPA/CPRA, GDPR, EU AI Act, and DPDP Act not only enforce legal requirements but also emphasize privacy and security expectations. However, nuances across each framework make it challenging to create one compliance model for all.

By monitoring regulatory changes and assigning responsibility to dedicated governance roles across the organization, enterprises can achieve compliance and more effectively mitigate risk. Managing regulatory changes should be more than a one-time exercise to meet compliance objectives. Only organizations that have the proper mindset and risk appetite will be able to thrive in today’s global environment. They will not just be able to mitigate risk but also position themselves as trusted leaders for their customers and stakeholders in an uncertain economic world.

Author Note

The views and opinions expressed in this article are entirely those of the author and do not reflect the views, policies, or positions of the author’s employer or any other organization with which the author is affiliated.

Endnotes

¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation [GDPR])
² California Privacy Protection Agency, “California Consumer Privacy Act Regulations (March 2023),” 8 July 2022, California Privacy Protection Agency, "Title 11. Law, Division 6. California Privacy Protection Agency.Chapter 1. California Consumer Privacy Act Regulations, Final Regulations Text” 
³ EU Artificial Intelligence Act, “High-Level Summary of the AI Act,” 27 February 2024
⁴ Government of India, Ministry of Electronics and Information Technology, Digital Personal Data Protection Act, 2023
⁵ The White House, Executive Order on Addressing the Threat Posed by TikTok, USA, 6 August 2020
⁶ National Institute of Standards and Technology, “Driving Innovation,”, International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), Joint Technical Committee on Information Technology (ISO/IEC JTC 1), ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection—Information security management systems—Requirements, Edition 3, 2022

SUMIT SHARMA | ITIL V3 FOUNDATION

Is an experienced IT risk and compliance leader with more than 15 years of work experience. Sharma drives innovation at the intersection of privacy, security, and compliance, automating controls, integrating AI into risk management, and leading programs that balance regulatory requirements with organizational growth. Sharma has delivered enterprise-scale initiatives in domains such as third-party risk, disaster recovery, access management, IT general controls, US Sarbanes-Oxley (SOX) Act compliance, US Federal Financial Institutions Examination Council (FFIEC) standards, and cybersecurity awareness trainings.