Are European Businesses Ready for the EU General Data Protection Regulation (GDPR)?

You have to ask, then, why businesses are not doing more to prepare and whether an underlying ‘head in the sand’ culture is leaving them vulnerable. The Crown Records Management Survey painted a worrying picture when it came to attitudes to data breaches, for instance, and suggested many of the UK’s data breaches are currently going unreported.

The most hard-hitting statistics include:

• 32 percent know someone in their company who has not reported a data breach
• 31 percent have delayed reporting a data breach to senior management or the appropriate authorities
• 29 percent have chosen not to report a breach to senior management or the appropriate authorities
• 27 percent know someone in their previous company who has not reported a data breach
• 14 percent don’t know who to report a breach to
• 8 percent don’t know what constitutes a data breach

Some of these statistics are shocking and suggest that data breaches may be far more common and more widespread than many people realize. That’s a big issue when you consider GDPR will bring in fines of up to 20m Euros or 4 per cent of turnover for data breaches in future. It also provides a strict timescale for the reporting of breaches (within 72 hours).

There appears to be a culture inside many companies that the best response to a breach is to ignore it or keep it quiet. Perhaps this comes from a fear of the loss of reputation which can be experienced when breaches are publicized. Or perhaps it is simply down to lack of clear procedures and information management in the business. Either way, the implications are serious. It is absolutely vital that businesses tackle this culture of secrecy because in future failing to report a breach will simply not be acceptable. In fact, it shouldn’t be acceptable now. Having a clear data protection and information management programme in place is vital for businesses to avoid these kind of problems. It should be very clear who is responsible for reporting breaches and who they should be reported to.

What many businesses seem to be missing is that there are also significant business benefits which arise from updating information management policies and becoming GDPR compliant. These include de-risking the business, cutting the cost of storage, and unlocking hidden value in data.

There is a strong belief in the industry that companies which can prove they are good custodians of personal data will gain a significant advantage over market rivals in future.

The ‘head in the sand’ approach could not only put reputations at stake but also see businesses miss out on future opportunities for growth.

Check out: CIOReview Europe