I was off travelling recently, and it occurred to me that when we buy services or products, we sell ourselves ideals. We like the thought of sipping artisan drinks in an opulent cocktail bar. We picture that expensive watch on a wrist. Aspirational marketing sells us status, novelty, and opportunity. Certainly what I actually want is “utility”.
The hotel I stayed in was a great example. It offered a grand marble-clad reception, fine art on the walls, and amazingly attenvive service. After my long journey though, that meant very little. What I actually wanted, standing there looking slightly bedraggled, was a clean room, a comfortable mattress, intuitive light switches, and fast Wi-Fi with a power outlet next to the bed. No amount of champagne compensates for a slow check-in experience or having to unscrew a bulb because I couldn’t figure out how to turn a reading lamp off. (I forgot to put it back in. Oops.)
The same tale applies to data protection, and compliance in general.
-
Management wants luxury compliance: think expensive enterprise-scale software platforms, 500 pages of all-encompassing policy written by the best lawyers, and elaborate dashboards that show up-to-date everything. It’s a popular approach partly because it offers an illusion of control. But over-engineered systems can create friction and annoyance, causing staff to bypass controls just to get work done on time.
-
Employees want utility. Quiet, fast, and frictionless compliance. One-page guides, not 50-page policies. A “report phishing” button directly in their email client. Pre-approved secure file-sharing tools that work well for sender and recipient.
Guests might book based on a hotel’s facilities, but reviews mention comfort and cleanliness more than art collections; an organisation’s compliance culture can be measured by how easily employees can achieve the right outcome in their everyday work.
I believe this gap exists because management designs compliance for ideal employees who read every policy and follow every rule, and employees are simply doing the best they can with conflicting demands. Management want comprehensive compliance and speed, accuracy, and low friction from staff. Understandable workflows and good habits really help to prevent most data breaches. For example, forcing multi-step approvals to share a document externally is an open invitation to find risky workarounds. Rather than adding layers of policy and bureaucracy, good compliance eliminates unnecessary effort so staff protect data by default while simply doing their work.
Recognising this changes how we build, buy, and govern. The compliance programmes that build lasting value aren’t made of decorative distractions or bureaucratic bloat, but those that deliver the fundamentals flawlessly. We might pay for the status of luxury, but we rely on effortless utility.
