The Norwegian Data Protection Authority’s fine of NOK 20 million imposed on Elkjøp/Elgiganten demonstrates how serious the consequences can be when consent, data processing, and documentation are not managed adequately.
But the case should not be viewed solely as a story about one company’s mistakes.
It should be seen as an example of a broader challenge facing many large companies: customer data is used across systems, channels, and purposes, and the more complex the business becomes, the more difficult it is to ensure that data is processed correctly.
That is exactly why GDPR should not be regarded solely as a legal matter, but as a business-critical project.
Most GDPR errors are not caused by bad intentions
The vast majority of companies want to process customer data correctly. They often have teams, processes, internal policies, and systems designed to create control and security.
Yet mistakes still happen.
Not necessarily because companies are trying to circumvent the rules, but because reality is complex. A modern customer journey often spans e-commerce, CRM, marketing, apps, physical stores, and customer service, with each system having its own data model, rules, and way of handling consent and customer profiles.
This means that a single customer may exist in several places at the same time, while consents, profiles, and preferences are not always updated or synchronized correctly.
Fragmented customer data creates real business risk
For many companies, customer data has become one of their most important assets. Data is used for personalization, loyalty programs, segmentation, campaigns, customer service, analytics, and automated communication.
But the value of that data depends on whether the company actually has control over it.
If consents and profiles are scattered across multiple systems, it becomes difficult to answer basic questions with confidence:
- What data do we have about the customer, and where does it come from?
- What has the customer consented to, and for which purposes are we allowed to use the data?
- How do we ensure that changes are reflected across all relevant systems?
Without a unified overview, compliance quickly becomes dependent on manual processes, interpretations, and technical workarounds. This may work for a while, but it does not scale well in organizations with many touchpoints, departments, and markets.
It is here – in the gaps between systems – that the risk is particularly likely to arise.
Compliance requires governance – not just good intentions
GDPR compliance is not only about having the right wording, policies, and legal assessments. It is about being able to translate the rules into everyday operational practice.
That requires governance.
Governance means that the company has clear rules for how customer data is created, updated, used, documented, and deleted. It ensures that responsibility does not disappear between departments and that systems support the organization’s decisions.
For larger companies, central governance should in particular cover four areas:
1️⃣ A unified view of profiles, so each customer can be identified uniquely and duplicates can be avoided.
2️⃣ Central management of consents and preferences, so it is clear what the customer has agreed to.
3️⃣ Operationalization of retention rules, so deletion deadlines can be enforced across systems.
4️⃣ Accessible documentation, so decisions, processes, and the underlying data can be accounted for.
RubiqCloud: A central foundation for consents and profiles
RubiqCloud is developed for companies that need a central consent and preference master. Not as yet another system, but as a layer designed to create coherence between CRM, CDP, marketing automation, and customer service.
With RubiqCloud, companies can create a central overview of customer consents, preferences, and permitted data usage. At the same time, consents and customer profiles can be kept up to date across channels and systems, ensuring that the entire organization works from the same data foundation.
This reduces the risk of incorrect communication, missing documentation, and uncertainty about how customer data may be used.
But the value is not only about avoiding compliance risk. When the underlying data is structured and reliable, the benefits are particularly evident in the following areas:
- Communication becomes more relevant
- The customer experience becomes more transparent
- Customer service gains a better overview of the customer
- Marketing becomes more targeted
From legal requirement to business-critical foundation
The most important lesson from cases such as Elkjøp’s is not that companies should be afraid to use customer data. Quite the opposite.
But data must be managed, documented, and activated correctly. That is why consent and compliance should not be considered only at the end of a project, but should form part of its foundation from the outset.
When GDPR is placed solely within the legal department, it risks becoming little more than a control checkpoint.
For large companies operating across many systems, channels, and markets, the question is therefore not whether GDPR is important, but whether the company has the data governance required to comply with the rules in practice.
It is a business-critical foundation.