Understandably, most organisations’ playbook for completing a digital transformation project tends to focus on operational and technical steps/challenges that need to be addressed in order to deliver on the potential offered by the project.  However, legal and compliance considerations are increasingly impacting on digital transformation projects.

In this briefing, we identify areas relevant to a digital transformation project that require particular attention from a legal and compliance perspective, so as to assist an organisation in: (i) identifying legal/compliance issues that can impact on the project; and (ii) successfully navigating those issues to smoothen the path towards realising the full potential of the project.

What is digital transformation?

Our experience is that for most organisations digital transformation focusses on investment in technology and related processes so as to enhance the organisation’s digital enterprise capabilities.  In practice, this frequently takes the form of an organisation transitioning to cloud-based solutions, implementing remote working solutions or harnessing the power of big data through data aggregation and harmonisation solutions. Regardless of its form, digital transformation is likely to present challenges to organisations alongside abundant opportunity and ultimately, identifying and addressing these challenges will play a key role in determining the success or otherwise of an organisation’s digital transformation project.

Legal and compliance considerations

We discuss below areas relevant to a digital transformation project that require particular attention so as to help an organisation identify and address key legal and compliance issues that can arise on such a project.

• Risk assessment – at the outset of a digital transformation project, organisations will generally document the rationale behind the project and assess the inherent risks associated with it. Frequently, this assessment will focus on technical and operational risks but the nascent stage of a project is also an opportune time to identify legal and compliance risks.  By doing so, an organisation may be able to avoid costly changes or delays to a project arising from legal or compliance issues identified at a late stage when there may be limited scope to adapt the project or slightly shift its course.  Early stage involvement of the legal and compliance teams can also accelerate their technical understanding of the digital transformation project, which in turn can result in efficiencies at later stages of the project.
• Oversight & governance – effective project management is frequently a key factor in the successfully delivery of digital transformation projects. Often, there are two key aspects to project management on these projects.  Firstly, the effective management and oversight of functions and personnel within the organisation that are involved in the project.  Secondly, the effective management and oversight of the vendors engaged by the organisation to deliver services and/or solutions as part of the project.  For regulated entities, engaging vendors might also constitute an outsourcing arrangement, which is subject to regulatory rules.  The legal team should be able to advise on whether these regulatory rules apply to any vendors being used for the digital transformation project.  If these rules do apply, the legal team should also be able to assist with the development of appropriate project management infrastructure so as to oversee and manage the relevant vendors in line with regulatory rules on outsourcing.
• Vendor contracting – having in place appropriate contractual arrangements with vendors involved in a digital transformation project is integral to mitigating certain legal and commercial risks associated with the project. Where an organisation is subject to regulatory rules around outsourcing, it will also need to assess whether its relevant vendor contracts need to include certain provisions for compliance with these rules.  An organisation should ensure that it has the requisite legal support and expertise in place to appropriately mitigate legal, regulatory and commercial risks through its contracts with the vendors involved on the digital transformation project
• Information security – information security is an increasingly important consideration on digital transformation projects and in some cases, a driving factor behind such projects. Information security is also an area that is attracting increasing attention from a range of regulators across the EU, including the Irish Data Protection Commission, the Central Bank of Ireland and the European Banking Authority.  It is, therefore, critical that legal and regulatory risks relating to information security and operational resilience are identified at an early stage of a digital transformation project.  Appropriate measures to mitigate such risks may include obtaining appropriate contractual assurances from vendors involved in the digital transformation project in relation to information security and requiring such vendors to be certified to an internationally accepted information security standard.
• Policies & procedures – new digital capabilities and technologies introduced by digital transformation projects will need to comply with certain legal and regulatory requirements on a continuous basis and organisations will need to ensure that they have appropriate infrastructure in place to support such compliance. One key aspect of this will be ensuring that the organisation’s new digital capabilities are supported by appropriate policies and procedures.  Such policies and procedures might include Acceptable Usage Policies and Information Security Policies.  Ultimately, an organisation’s legal and compliance teams should be able to advise on the nature and substance of these policies.

Early stage collaboration leading to better outcomes

The journey towards successful digital transformation is not one that an organisation’s commercial and technology teams should take in isolation.  Ultimately, successful digital transformation require collaboration with other functions within the organisation, including the legal and compliance teams.  Our experience is that initiating such collaboration at an early stage of the project leads to more effective identification and resolution of issues and generates efficiencies, which will benefit the project at a later stage.  In particular, early stage collaboration with the legal and compliance teams can help to mitigate issues relating to the use of data, ownership and use of intellectual property and regulatory risk (e.g. GDPR, EBA guidelines on outsourcing arrangements, etc.).

Our Technology Transformation and Sourcing team at Arthur Cox has considerable experience in advising a range of clients on digital transformation projects.  If we can be of any assistance on your organisation’s digital transformation project, please contact the authors of this briefing.