Finally, after two years of waiting, Europe’s General Data Protection Regulation takes effect starting today, May 25.
Beyond just Europe, the regulation is expected to reshape how global organizations manage, share and protect their users’ personal data. Many organizations across the world have scrambled to be ready. But based on public statements from companies and client feedback, it is clear that many companies are still not in compliance.
Still, with all the high-profile data breaches and misuses we have witnessed in the last few months; i.e. Equifax and Cambridge Analytica, global businesses are taking GDPR seriously.
Not knowing the extent and depth to which the EU will enforce GDPR, the potential fines of up to 4 percent of global annual revenue or 20 million euros should still inspire an immediate need to review and subsequently adjust data privacy and protection programs. As a result, companies will have to restructure how they handle data, and, if they do not have a cyber infrastructure that is sound, they will have to rebuild from the ground up including their applications.
Even if the GDPR does not directly affect your organization, the requirements and guidelines contained within can help any organization obtain resilient data privacy and protection.
Who is in compliance?
The answer differs based on several factors. Over the past two weeks there have been at least four distinct studies with very different results.
On May 21, a new GDPR study carried out by the Ponemon Institute found that 40 percent of the companies surveyed would not be ready.
A Crowd Research Partners report drawn from the Information Security Community on LinkedIn, says that only 40 percent of the organizations surveyed would be fully compliant by today’s GDPR deadline.
A World Federation of Advertisers (WFA) survey released on May 23 stated that 95 percent of respondents planned to be fully compliant by the deadline, of which 74 percent said they believe their company would likely be fully compliant by the deadline, with 42 percent of those respondents saying they would definitely be.
A Netsparker GDPR survey of 300 senior executives found that only 2 percent of those surveyed said that they do not expect to be compliant by today’s deadline.
The various survey results indicate that there is still much confusion around GDPR.
For those organizations that are playing catch-up with GDPR, the first step is to realize that they will need their customers permission to collect and process their data. This includes internal tools used to share or analyze the data internally, exclusive of tools that encrypt the data end to end.
The steps should be prioritized by risk and execution complexity within your organization.
Please click here to read the entire article originally published by Information Management.