Hospitality brand drives global data compliance

Increased regulatory and litigation risk

Customer data powers personalized digital experiences, but organizations are under growing pressure to demonstrate that they collect and manage that data in compliance with regulatory requirements and their published practices. In 2025, the California Consumer Privacy Act (CCPA) alone issued almost $4 million in regulatory fines for noncompliance. Plus, some litigators now use tools to identify noncompliant digital interfaces and file suits against large companies that own them.

One large hospitality brand with more than 1,000 digital interfaces faced growing exposure from data compliance claims and regulatory inquiries, adding up to approximately $2 million in annual legal and settlement costs.

The company’s web properties were decentralized across brands, business units, geographies and third-party providers. Leaders needed greater visibility into this digital ecosystem, with an approach to applying customer data preferences and management consistently across all digital interfaces. Most of all, they needed a governance model that could enforce consistent data compliance across various ownership structures and operating requirements.

A governance program for a complex ecosystem

A Grant Thornton team designed a risk-prioritized data compliance program that combined assessment, governance and remediation with ongoing compliance monitoring. The objective was to establish centralized governance capable of supporting a large and evolving digital ecosystem into the future.

Working with stakeholders across the organization, the team inventoried websites and digital interfaces, prioritized customer data risks and established standards for evaluating compliance obligations. The team also developed governance mechanisms, audit approaches and remediation processes that could be applied consistently across the organization’s web presence.

To support long-term program sustainability, Grant Thornton helped the company create a shared-cost framework that improved accountability and transparency across digital interface owners. The approach encouraged standardization where appropriate while allowing flexibility for localized operating needs. It also helped identify opportunities to simplify vendor relationships and reduce compliance complexity.

Recognizing that websites, technologies and regulatory expectations continue to change, the company enlisted ongoing managed support from Grant Thornton to help maintain oversight, monitor changes and update compliance activities over time.