Fear and checklists — that was the recipe for many of us when GDPR stormed onto the scene in 2018.

My playbook back then?

• Calculate 4% of annual turnover as the potential fine
  
  
• Use that figure to get leadership's attention
  
  
• Read the GDPR for minimum requirements
  
  
• Build a spreadsheet with processing records and risks
  
  
• Check the boxes – then get back to the core business
  
  

But now it’s 2025, and that approach no longer works.

The fear turned out to be unfounded

We used fear as leverage:
“If you don’t comply, you could be held personally liable. Goodbye board positions. Goodbye to Ferraris and Caribbean holidays.”

In reality, that strategy has proven counterproductive. For most companies, the risk of being caught is low, and the fines have, in practice, been relatively modest.

Many leaders have come to realize there was nothing to fear.

As one of my former bosses often said to our PR clients:
"It’s a strong message – right up until the journalist asks a follow-up question."

The same applies in compliance. If the entire argument is built on fear, the inevitable question follows: “But how likely is that really?”

Compliance should instead be built on a positive narrative – one that focuses on how a data protection program supports the business and creates value for people.

{{factbox-dark}}

Checklists are no longer enough

The other part of my playbook was all about checklists. Probably yours too.

Checklist compliance isn’t just outdated – it’s inadequate in a world where risks and external expectations are constantly evolving. Instead, we need an approach that enables us to make balanced decisions about information security and data protection.

Yes, spreadsheets can be useful.
But they are rarely enough as a long-term compliance tool.

Many GDPR records from 2018 have never been updated.

It takes dynamic systems and ongoing integration with the business.

And perhaps most importantly: Compliance shouldn’t just be about being compliant – it should be about feeling confident in the processes and the work we do.

The future of GRC?‍

It demands more than checklists and fear.

It requires an eye for complexity, the courage to navigate change – and a willingness to make compliance a natural part of the business.

Not because we have to. But because it makes sense.