Why Data Protection Authorities Need a Practical Framework for Global Business

By Eckhart Mehler for CISOsCISO — a perspective on cybersecurity leadership, governance and the decisions that determine whether organizations retain control.

European data protection law was never designed to prohibit global business.

Yet many organizations are finding themselves in exactly that position.

Across Europe, CISOs, Data Protection Officers and legal teams increasingly face the same dilemma:

A messenger platform may be unacceptable under a strict interpretation of the GDPR. But in another part of the world, that same platform is effectively the only way to communicate with customers, suppliers, authorities or local employees.

China has WeChat.

South Korea has KakaoTalk.

Japan has LINE.

Other regions rely heavily on Telegram, WhatsApp or locally dominant messaging ecosystems.

Ignoring this reality does not make it disappear.

Banning these platforms globally does not eliminate the communication. It merely pushes it onto unmanaged personal devices, private accounts and completely invisible Shadow IT.

Ironically, the pursuit of perfect compliance can produce the exact opposite outcome: less security, less accountability and less privacy.

That is the governance gap Europe still has not addressed.

The GDPR Was Built Around Accountability

The GDPR deliberately avoids prescribing technologies.

Instead, it establishes principles:

• accountability,
• proportionality,
• data minimization,
• security,
• transparency,
• purpose limitation,
• and documented risk assessment.

This flexibility is one of its greatest strengths.

However, when it comes to globally operating organizations, one important piece is missing.

There is still no practical orientation explaining how European organizations should manage communication platforms that are legally problematic under European standards but operationally unavoidable in certain regions.

Current guidance explains what organizations should avoid.

It rarely explains how they should safely manage unavoidable realities.

For CISOs, this distinction is enormous.

Security and Privacy Are Not Always Aligned

Many discussions reduce messenger platforms to a binary question:

“Allowed or prohibited.”

Reality is considerably more complex.

From a security perspective, a total prohibition may create significantly greater risks than a carefully controlled exception.

Consider a multinational organization operating in more than one hundred countries.

A complete prohibition may result in:

• employees using private smartphones,
• personal accounts,
• uncontrolled contact synchronization,
• absence of logging,
• no incident response capability,
• unmanaged endpoints,
• no mobile device management,
• no awareness program,
• no legal oversight.

None of these outcomes improve privacy.

None improve cybersecurity.

None improve governance.

The organization simply loses visibility.

Security leadership should never confuse prohibition with control.

The Missing Guidance

German supervisory authorities have published valuable recommendations regarding messenger services.

They discuss encryption.

Metadata.

Technical safeguards.

Healthcare scenarios.

General GDPR obligations.

International transfers.

All of these are important.

Yet global enterprises face a completely different operational question:

How can unavoidable messenger usage be governed responsibly without abandoning GDPR principles?

This question remains largely unanswered.

Where Organizations Need Practical Guidance

1. Regional Exceptions

Not every country operates under European communication norms.

Some economies function almost entirely through local messaging ecosystems.

Organizations need objective criteria defining:

• when regional exceptions are justified,
• who approves them,
• how frequently they are reviewed,
• how they are documented,
• when they must be withdrawn.

Without such criteria, every regional office invents its own rules.

2. Corporate Containers

The distinction between a messenger platform and its deployment model is often ignored.

Running a messenger inside a managed corporate container differs fundamentally from using a personal application on an unmanaged device.

Future guidance should clarify:

• supported container architectures,
• identity separation,
• certificate usage,
• encryption boundaries,
• remote wipe capabilities,
• enterprise policy enforcement.

Technology changes risk dramatically.

Current guidance rarely reflects this.

3. Managed Devices

One unmanaged smartphone can become an enterprise data leak.

Conversely, a fully managed mobile device may provide:

• compliance monitoring,
• encryption,
• policy enforcement,
• application control,
• certificate management,
• logging,
• remote response.

The regulatory discussion should distinguish between these environments instead of treating every smartphone identically.

4. Data Classification

Perhaps the most overlooked issue is not the messenger itself.

It is the data being transmitted.

Few organizations need every type of corporate information to be exchanged through every communication channel.

Future guidance could distinguish clearly between:

• public information,
• low-risk operational communication,
• confidential business information,
• HR records,
• financial information,
• regulated personal data,
• security-sensitive information,
• classified information.

Risk depends heavily on data classification.

Current discussions often focus only on applications.

5. Communication with External Parties

Many organizations do not choose the communication platform.

Their customers do.

Their suppliers do.

Their government partners do.

Their humanitarian partners do.

Especially in international development, humanitarian assistance and crisis response, refusing to use dominant regional communication channels may effectively prevent operations.

This operational reality deserves explicit regulatory consideration.

6. Metadata

Encryption receives enormous attention.

Metadata receives surprisingly little.

Yet communication patterns often reveal:

• organizational structures,
• supplier relationships,
• executive interactions,
• project activities,
• geographical movements,
• business priorities.

Reducing metadata collection may sometimes provide greater privacy gains than focusing exclusively on message content.

Future guidance should reflect that reality.

7. Records Management

Corporate communication is not merely communication.

It is often business documentation.

Organizations need practical guidance regarding:

• retention,
• legal hold,
• export,
• auditability,
• evidence preservation,
• incident investigations,
• deletion obligations.

Many messenger platforms were never designed for corporate records management.

Ignoring this challenge does not remove legal obligations.

8. Local Law versus Corporate Accountability

This is perhaps the most difficult governance challenge.

Local legislation may require one approach.

European headquarters another.

Who ultimately decides?

The regional manager?

The DPO?

The legal department?

The CISO?

The executive board?

The GDPR clearly establishes accountability.

Operational guidance should explain how that accountability functions inside multinational governance structures.

9. Article 49 GDPR

Organizations frequently ask whether occasional communication through a locally dominant messenger may rely on Article 49 GDPR.

The European Data Protection Board has repeatedly emphasized that Article 49 represents a narrow exception rather than a permanent operational model.

Yet organizations still need practical examples illustrating:

• occasional use,
• emergency communication,
• humanitarian operations,
• crisis response,
• customer-initiated conversations,
• exceptional governmental interactions.

Concrete examples would significantly improve legal certainty.

10. Demonstrating Business Necessity

Saying “everyone uses it” is not evidence.

Organizations should be expected to demonstrate factual necessity.

But how?

Possible criteria might include:

• customer requirements,
• supplier dependence,
• governmental mandates,
• regional market analysis,
• documented alternatives,
• business continuity implications,
• operational risk assessments.

Without objective criteria, necessity becomes subjective opinion.

11. When Controlled Tolerance Is Safer Than Absolute Prohibition

This may be the most uncomfortable discussion.

Sometimes allowing limited, tightly governed use produces less overall risk than attempting total prohibition.

A controlled exception may include:

• managed devices,
• enterprise identities,
• defined data classifications,
• documented approvals,
• awareness training,
• monitoring,
• incident response,
• periodic reassessment.

A blanket prohibition often results in exactly the opposite.

Shadow IT.

Personal devices.

Invisible communication.

Lost accountability.

The objective of regulation should never be symbolic prohibition.

It should be demonstrable risk reduction.

The Governance Question

This discussion is no longer about messenger applications.

It is about governance maturity.

Organizations increasingly operate across fundamentally different legal, cultural and technological environments.

Privacy law must remain robust.

But it must also remain operational.

Otherwise, governance becomes disconnected from reality.

And disconnected governance is rarely effective governance.

What the DSK Could Contribute

The German Data Protection Conference has the opportunity to provide exactly the practical orientation global organizations need.

Not by approving individual applications.

Not by lowering GDPR standards.

But by publishing a structured, risk-based governance framework addressing unavoidable global communication scenarios.

Such guidance could define:

• governance principles,
• minimum technical safeguards,
• approval processes,
• documentation expectations,
• accountability models,
• review mechanisms,
• acceptable exception management,
• and measurable controls.

That would strengthen both privacy and cybersecurity.

The Real Question

European organizations are not asking whether privacy matters.

They already know it does.

They are asking something much more practical:

How can they remain compliant when global business reality refuses to align with European communication ecosystems?

That question deserves more than silence.

It deserves guidance.

Because governance is not measured by how easily it manages ideal situations.

It is measured by how responsibly it manages unavoidable ones.

Publication Note & Disclaimer
This article reflects my personal professional perspective and does not represent the official policy or position of my employer. Drafting and editorial refinement may have been supported by commercially available AI-assisted tools. The analysis, conclusions and final curation are entirely my own.

For information regarding image credits, copyrights, trademarks and other intellectual property rights, please refer to the Imprint.