This has lead to a lot of confusion within companies about what exactly it is that they need to be doing in order to reach compliance. Box has been helping customers to navigate this confusion where it can, by attempting to educate them about the best way to ensure they're up to standard. "Through sharing our own experience," Benjamin said, "we find that resonates a lot with some of our customers."
"This isn't a core part of our business, but it's the advisory services we provide, which we provide just because this is a subject we're really interested in, and we've got some really fascinating people internally," he said. "We've built up a huge amount of talent in this area, and we just like talking about it a lot."
"I personally think, for Box, that we are particularly well-positioned to help organisations navigate their way to making sure that they demonstrate the right activities in a post-GDPR environment."
Box is undeniably strong when it comes to matters of regulation and compliance; the company is one of only two organisations globally to possess the stringent C5 certification established by Germany's data protection authority, and has had its binding corporate rules approved by all 27 EU member states. Box prides itself on finding the highest data protection standards in the world, and then making a concerted effort to exceed them.
However, Benjamin was also keen to stress that although Box can help its clients meet the requirements of GDPR to a certain extent, at the end of the day it's up to the organisations themselves to ensure that they don't fall foul of the rules. The company runs webinars, group sessions and tutorials, for example, but it can't appoint a DPO or deal with the aftermath of a data breach within the company.
"Box doesn't extend its services to 'making customers GDPR-compliant'," he said; "that's not Box's responsibility. We can advise how we've done so, and we can actually point towards our own DPO, but it is a company's responsibility to appoint their own data protection officer."
Whether or not organisations think they should be concerned about GDPR, the fact is that the new regulations are going to fundamentally change the way that businesses think about compliance and data privacy.
"It's the next Y2K," Benjamin said. "And I don't think that's such a bad thing. At Box, we welcome and relish the opportunity for compliance standards to be set at an appropriate level, and we encourage our customers to think about raising the bar as well."
"I do think GDPR is setting a new tone and a new topic of conversation - what did we talk about before GDPR?"
