A study conducted by multi-cloud data management specialist Veritas Technologies has found that organisations across the globe mistakenly believe they’re in compliance with the upcoming General Data Protection Regulation (GDPR). According to findings from The Veritas 2017 GDPR Report, almost one-third (31%)) of respondents said that their enterprise already conforms to the legislation’s key requirements. However, when those same respondents were asked about specific GDPR provisions, most provided answers that show they’re unlikely to be in compliance. In fact, upon closer inspection, only 2% actually appear to be in compliance, in turn revealing a distinct misunderstanding over ‘regulation readiness’.
“With the EU’s GDPR now less than one year away, organisations around the world are deeply concerned about the impact that information non-compliance can have on their brand and, indeed, the loyalty of their customers,” said Jason Tooley, vice-president for Northern Europe at Veritas.
The findings from the report* show that almost half (48%) of organisations who stated they’re compliant don’t have full visibility over personal data loss incidents. Moreover, 61% of the same group admitted that it’s difficult for their organisation to identify and report a personal data breach within 72 hours of awareness – a mandatory GDPR requirement where there’s a risk to data subjects. Any organisation that’s unable to report the loss or theft of personal data – such as medical records, e-mail addresses and passwords – to the supervisory body within this timeframe is breaking with this key requirement.
The findings in this report suggest that organisations believing they’re already compliant with the GDPR should revisit their compliance strategies. As has been widely publicised, any proven failure to meet GDPR requirements could attract a fine of up to 4% of global annual turnover or €20 million, whichever is the greater.
Tooley added: “These study results show that more education is needed on the tools, processes and policies to support the information governance strategies that are required to comply with the GDPR’s requirements. Creating an automated, classification-based, policy-driven approach to GDPR is the key to success and will enable organisations to accelerate their ability to meet the regulatory demands within the short timeframes available.”
Former employee threat
Restricting former employee access to corporate data and deleting their systems credentials helps to stem malicious activity and ensure that financial loss and reputational damage are avoided.
However, a staggering 50% of so-called compliant organisations said that former employees are still able to access internal data. These findings highlight the fact that even the most confident of organisations do struggle to control former employee access and are potentially susceptible to attacks.
Under the GDPR, EU residents will have the right to request the removal of their personal data from an organisation’s databases. However, Veritas’ research shows many organisations that stated they’re already in compliance will not be able to search, find and erase personal data if the ‘right to be forgotten’ principle is exercised.
Of the organisations that believe they’re GDPR-ready, one-fifth (18%) admitted that personal data cannot be purged or modified. A further 13% conceded that they don’t have the capability to search and analyse personal data to uncover explicit and implicit references to an individual. They’re also unable to accurately visualise where their data is stored because their data sources and repositories are not clearly defined.
These shortcomings would render a company non-compliant under the GDPR. Organisations must ensure that personal data is only used for the reasons it was collected and then deleted when it’s no longer needed.
Demystifying GDPR responsibility
Veritas’ research also found that there’s a common misunderstanding among organisations regarding the responsibility of data held in cloud environments.
Almost half (49%) of the companies that believe they comply with the GDPR consider it the sole responsibility of the cloud service provider (CSP) to ensure data compliance in the cloud. In fact, the responsibility lies with the data controller (ie the organisation) to ensure that the data processor (ie the CSP) provides sufficient GDPR guarantees. This perceived false sense of protection could lead to serious repercussions once the GDPR is enacted.
“Organisations who actively focus on the development of a culture of data confidence will have a clear business advantage,” commented Tooley. “Customer and supplier confidence in the use of data is critical to improved customer engagement, greater personalisation and, ultimately, service quality. This allows organisations to turn the GDPR from being a regulatory challenge into a business differentiator. The complexity created through the management of data across multiple cloud and on-premise environments is accentuating the challenge and will inhibit an organisation’s ability to remain compliant in the face of the GDPR articles. For every organisation that’s currently struggling to make sense of the GDPR’s provisions, it should immediately seek an advisory service to audit its levels of preparedness and create a smooth and accelerated path towards total compliance.”
The GDPR is intended to harmonise data privacy and protection mandates across European Union (EU) Member States. It requires organisations to implement the appropriate protection measures and processes to effectively govern personal data.
The GDPR will take effect on 25 May 2018 and apply to any organisation – inside or outside the EU – that offers goods or services to EU residents or monitors their behaviour.
*Veritas Technologies commissioned independent technology market research specialist Vanson Bourne to undertake the research upon which the final report is based. A total of 900 business decision-makers were interviewed in February and March across the UK, the US, France, Germany, Australia, Singapore, Japan and the Republic of Korea. The respondents were from organisations with at least 1,000 employees and could be from any sector. To qualify for the research, respondents had to be from organisations transacting at least some business with the EU. Interviews were conducted online using a rigorous multi-level screening process to ensure that only suitable candidates had the opportunity to participate