Data (in)Flux: Maintaining your Reputation as a Business Subject to Data Protection Laws.

Today’s world is nothing like the one we grew up in. Volatility, invasive technology, and social media mean we live in a world without privacy. This applies in a personal and commercial sense.

Many readers will have businesses that have lasted multiple years, reacting and adapting to technological changes.

Although you have managed so far, how can your company maintain its commercial reputation in today’s era of AI, scams, and cyberattacks?

The Law

Data laws exist in most developed countries to control how personal information is collected, processed, and used. In the UK, the General Data Protection Regulation (GDPR) and the Data Protection Act govern how data is managed.

Fairness, transparency, accuracy and security underpin the obligations of data controllers. Should anyone breach these obligations with your data, you should report them to the Information Commissioner’s Office (ICO).

Reviews in Action: Case Studies of Data Breach PR Nightmares

1. Social Media – Cambridge Analytica and Meta (Facebook).

What Happened?

Cambridge Analytica, a now-defunct political consulting firm, secretly harvested consumer data from Facebook and used this information to (potentially) influence the 2016 US election and the Brexit vote.

The scandal uncovered how 50 million Facebook profiles were compromised by using a personality quiz app. The app’s data controllers passed the data on to Cambridge Analytica in breach of the weak data frameworks in place. This breach compromised all accounts connected to a user of the personality app, bringing far-reaching consequences.  

How did this Affect Business?

Facebook’s name was dragged through the press, user trust plummeted, and regulatory investigations followed. This is why Facebook rebranded to ‘Meta’ in 2021. Cambridge Analytica had to cease trading completely.

Without admitting fault, Facebook agreed to pay a mammoth $725 million class action lawsuit, the largest of its kind in US history. The reputational cost was even higher than the settlement, affecting user numbers, engagement, and investor confidence.

Lessons Learned

• Reputation has value, especially in the fickle world of social media. Public trust is tied to consumer retention, market share, and investor confidence, which can make or break any business.
• Regulatory exposure is expensive. Settlements and investigations often lead to the disclosure of further crimes and further lawsuits. Even without broken laws, data mismanagement can cost companies millions.
• Governance failures reflect on leadership. A single incident can raise serious questions about the oversight of your company and the culture you created.

  2. Invasive Technology – 23andMe and Bankruptcy.

It is hard to find more personal data than your own DNA. In fact, the UK government places stronger legal protection for sensitive data such as genetics and biometrics than less personal data, such as marketing information. This explains the ICO’s warning of legal action in response to the following article:

What Happened?

The genetic testing company 23andMe, often used to create family trees and ethnicity profiles, faced a 2023 cyberattack which compromised 6.9 million customer profiles and precious genetic information.

How did this Affect Business?

Following disastrous reputation management and an inability to maintain consumer trust, 23andMe filed for Chapter 11 bankruptcy proceedings in 2025 following this massive reputational hit. A core concern now is genetic data being sold to a third party by a trustee in Bankruptcy, as stakeholders will not back a business that can’t secure its core asset.

This breach has raised significant concerns about the data of UK customers. The ICO has responded by threatening legal action against 23&Me, aiming to safeguard the personal data of UK users and create a precedent for handling corporate insolvency.

Lessons Learned

• Invasive and personal data demands higher compliance standards. Genetic and biometric data are subject to stricter legal protections and mismanaging them carries elevated risks.
• Crisis response is critical. Mishandling communication and failing to reassure your customers can escalate commercial damage faster than a breach.
• Insolvency doesn’t eliminate data obligations. Regulatory duties survive business failure, and trustees may face scrutiny over how data is handled.

3. Managing Volatility – Co-op Data Breach 2025.

What Happened?

The Co-op faced a significant data breach last week. Hackers launched a cyberattack with the intent of deploying ransomware, which demands money for the release of information on company systems. The hacker’s plan was thwarted when the Co-op identified suspicious activity and took critical systems offline to prevent the ransomware. The Co-op managed this issue extremely well, imposing short-term disruption through the shutdown rather than long-term uncertainty as seen at M&S.

How did this Affect Business?

• Operational Disruption: The co-op’s preemptive shutdown led to immediate challenges, including empty shelves and disrupted supply chains. However, by thwarting the hackers, they ensured this disruption was short-term.
• Short-term Distrust: This incident still led to stolen customer data; however, it was not financial data. Although consumer trust decreased, the Co-op is extremely fortunate that M&S is undergoing the same fallout.
• Financial Impact: The cyberattack led to a 6.5% decline in the Co-op’s share price, erasing over half a billion pounds from its market value.

Lessons Learned

• Data breach detection matters. Co-op’s ability to quickly identify the attack allowed them to act decisively. This is only possible with the proper infrastructure and staff in your IT team.
• Proactive shutdown can be a commercial shield. While sales were lost, the company retained control of its infrastructure and avoided more severe damage.
• Crisis planning pays off. Coordinated internal responses, even under pressure, reduce reliance on external actors and signal control to regulators and customers.
• Proactive decisions still have costs, but they are often less expensive than the alternative. M&S’s prolonged operational paralysis highlights how inaction or a late reaction can deepen financial and reputational loss.

Conclusion: How Can Your Company Manage its Reputation through Data?

Security – Implement effective anti-virus software if you cannot afford to pay for a dedicated IT support team.

Accuracy – Ensure your data is current and accurately relates to customer information.

Transparency—Ensure your customers know how their data is handled, processed, and used. Rather than relying on the small print of privacy notices, improve customer trust by properly informing them of their rights.

Necessity – Only retain data when you need to. Dormant files of ex-employee data are easy pickings for a hacker. When you no longer need employee data, ensure it is deleted and destroyed following government guidance.

Consult the ICO Checklist – See how well you comply with data protection law.

https://ico.org.uk/for-organisations/advice-for-small-organisations/checklists/assessment-for-small-business-owners-and-sole-traders/