When Legacy Meets Privacy: Non-Digital Industries Struggle with Data Governance and Consent

Despite the widespread growth of privacy legislation in the US and globally, many companies—especially those outside of tech’s digital-first sphere—are still playing catch-up. A recent report showed that fewer than half of US organizations have taken the most basic steps toward compliance with state privacy laws. Industries such as manufacturing, agriculture, construction, and education, which historically centered on physical infrastructure and tangible operations rather than personal data, now increasingly touch on sensitive information—yet often lack the systems, policies, and culture needed for robust privacy protection and consent management. 

Organizations entrenched in traditional practices frequently rely on outdated, inflexible infrastructure. Data in the form of employee records, supplier information, or customer details resides across fragmented repositories: physical paper files, siloed databases, or decades-old legacy systems. These systems typically lack built-in hygiene, auditability, or defensible data disposal methods. Secure deletion protocols are often missing or inconsistently applied, rendering organizations vulnerable to regulation or breach—but research shows that even among sectors where data sanitization policies exist, only 62% believe these policies are well-communicated across their operations. 

Similarly, when these legacy industries do take steps into the digital realm, many as basic as launching websites and basic digital marketing initiatives, they are woefully unprepared and uninformed about their legal and regulatory responsibilities vis-à-vis data privacy, data protection, cookies, consent and compliance.  

Manufacturers, arguably the most emblematic of non-digital-first industries, are increasingly being targeted by cybercriminals. A 2023 report found manufacturing accounted for over 25% of cyberattacks globally, making it the most targeted industry. In 2022 alone, over 130 data breaches impacted manufacturing firms—exposing 38 million records.  

With this kind of data insecurity, there is no such thing as data privacy – so even the basics of cybersecurity, completely ignoring the point at which a website visitor would opt in to or out of cookies, are not managed properly.  

Unlike GDPR in Europe—a comprehensive, unified framework—US data privacy laws are a patchwork of state statutes (like CCPA) combined with sector-specific regulations such as HIPAA or COPPA. That leaves many traditional industries without a single cohesive standard to follow. 

Moreover, requirements are evolving rapidly. In the EU, directives such as NIS2 (Network Information Security 2) and DORA introduce stringent cybersecurity, resilience, and reporting obligations across a wider set of sectors—including manufacturing, food processing, and utilities. Non-digital firms often lack the preparedness for such sweeping mandates. Without the most fundamental preparedness for cyber resilience, focus on data privacy and consent compliance will feel like an afterthought, despite the financial and reputational risks non-compliance can introduce.  

Beyond systems and regulations, many traditional firms face cultural inertia. Priorities have historically focused on production efficiency or legacy operational KPIs—not on data privacy, securing consent, or digital risk. Without a catalyst—like regulatory investigation or major breach—there’s little appetite for investing in teams, tools, or processes to embed privacy by design. While anecdotal, many of us have worked in traditional industries where even legal and IT teams seem like they are treading water in the face of changing data privacy and governance regulations.  

Even though these teams are tasked with both legal and technical enforcement, a significant part of the resistance can live at this level. An example is an infrastructure construction company taking baby steps into digital marketing. While their websites had finally brought their cookie policies and cookie consent banners in line with GDPR, they had no clear approach to managing consent beyond that. Sales teams, enthusiastic about digital marketing opportunities but uninformed about GDPR and consent, insisted on sending newsletters and email marketing without having received any opt-in consent. Marketing argued against this (armed with knowledge about GDPR and the fact that no CRM existed that could help keep track of consent and opt-ins), but the IT team, rooted in practices from a decade or more ago, sided with sales until marketing consulted a lawyer who advised absolutely do not do this. This illustrates the tension and tenor of the argument – mostly fueled by well-meaning people who have never worked in digital-first environments. 

Whether starting from scratch or working with a light digital footprint, traditional industries can get on the right path with regard to data privacy and consent with a few important steps: 

Make everyone in the organization aware of and responsible for data privacy. Whether this is through formal education or constantly embedding this knowledge into every piece of internal communication, it’s a big step toward conquering cultural resistance to change. 

Data privacy isn't only a concern for digital giants. The so-called “analog” industries—manufacturing plants, educational institutions, construction firms, agricultural operations—are waking up to the reality: they too hold personal data, can be cyberattack targets, and, if they have any digital presence at all, must comply. 

The path forward demands investment—not just in technology, but in governance, culture, and strategy. By building data-aware operations and framing privacy as both responsibility and opportunity, legacy industries can transform what used to be a crippling compliance burden into a foundation for trust, resilience, and innovation. 

A practical step for legacy organizations is adopting a consent management platform (CMP). These platforms centralize how businesses capture, store, and honor individual consent preferences across websites, applications, and even offline systems.  

For industries with fragmented legacy infrastructure, a CMP offers a single source of truth—ensuring that consent signals are consistently respected regardless of where the data originates. This not only simplifies compliance with frameworks like GDPR, CCPA, and the range of US state laws but also builds trust with employees, partners, and customers who increasingly expect transparency and control over their personal information. By layering a CMP onto existing systems, even non-digital-first companies can modernize their privacy practices without needing to overhaul their entire IT environment.