Only two percent of “GDPR-ready” organizations are compliant
A study from Veritas Technologies, a leader in multi-cloud data management, has found that organizations across the globe mistakenly believe they are in compliance with the upcoming General Data Protection Regulation (GDPR).
According to findings from The Veritas 2017 GDPR Report, almost one-third (31 percent) of respondents said that their enterprise already conforms to the legislation’s key requirements. However, when those same respondents were asked about specific GDPR provisions, most provided answers that show they are unlikely to be in compliance. In fact, upon closer inspection, only two percent actually appear to be in compliance, revealing a distinct misunderstanding over regulation readiness.
The findings from the report show that almost half (48 percent) of organizations who stated they are compliant do not have full visibility over personal data loss incidents. Moreover, 61 percent of the same group admitted that it is difficult for their organization to identify and report a personal data breach within 72 hours of awareness – a mandatory GDPR requirement where there is a risk to data subjects. Any organization that is unable to report the loss or theft of personal data – such as medical records, email addresses and passwords – to the supervisory body within this timeframe is breaking with this key requirement.
The findings in this report suggest that organisations that think they are already compliant with the GDPR should revisit their compliance strategies. Failure to meet GDPR requirements could attract a fine of up to four percent of global annual turnover or €20 million, whichever is greater.
The former employee threat
Restricting former employee access to corporate data and deleting their systems credentials helps to stem malicious activity and ensure that financial loss and reputational damage are avoided. Yet, a staggering 50 percent of so-called compliant organizations said that former employees are still able to access internal data. These findings highlight that even the most confident organizations struggle to control former employee access and are potentially susceptible to attacks.
Challenges exercising “the right to be forgotten”
Under the GDPR, EU residents will have the right to request the removal of their personal data from an organization’s databases. However, Veritas’ research shows many organizations that stated they already are in compliance will not be able to search, find and erase personal data if the “right to be forgotten” principle is exercised.
Of the organizations that believe they are GDPR-ready, one-fifth (18 percent) admitted that personal data cannot be purged or modified. A further 13 percent conceded that they do not have the capability to search and analyze personal data to uncover explicit and implicit references to an individual. They are also unable to accurately visualize where their data is stored, because their data sources and repositories are not clearly defined.
These shortcomings would render a company non-compliant under the GDPR. Organizations must ensure that personal data is only used for the reasons it was collected and is deleted when it’s no longer needed.
Demystifying GDPR responsibility
Veritas’ research also found that there is a common misunderstanding among organizations regarding the responsibility of data held in cloud environments. Almost half (49 percent) of the companies that believe they comply with the GDPR consider it the sole responsibility of the cloud service provider (CSP) to ensure data compliance in the cloud. In fact, the responsibility lies with the data controller (the organization) to ensure that the data processor (the CSP) provides sufficient GDPR guarantees. This perceived false sense of protection could lead to serious repercussions once the GDPR is enacted.
Johnny Karam – VP Emerging Market at Veritas, comments: “Data is one of the most valuable assets of any organization. With the enormous growth in the type and volume of data held within an organization, the challenge of data management is growing significantly. The fundamental requirement of good data governance is visibility and classification but to comply with GDPR, organizations must be able to locate, search and minimize the amount of personal data held, as well as protect and actively monitor this data. GDPR certainly creates a potential new risk for Middle East organizations but also an opportunity to develop good data governance and management practises – the starting point should be a comprehensive data audit to help mitigate this risk before GDPR comes into effect.”
The GDPR is intended to harmonize data privacy and protection mandates across European Union (EU) member states. It requires organizations to implement the appropriate protection measures and processes to effectively govern personal data. The GDPR will take effect on May 25, 2018 and will apply to any organization – inside or outside the EU – that offers goods or services to EU residents, or monitors their behavior.
For information on how Veritas Technologies can help your organisation become GDPR compliant visit https://www.veritas.com/gdpr.
Veritas commissioned independent technology market research specialist Vanson Bourne to undertake the research upon which this report is based.
A total of 900 business decision makers were interviewed in February and March across the US, the UK, France, Germany, Australia, Singapore, Japan and the Republic of Korea. The respondents were from organizations with at least 1,000 employees, and could be from any sector. To qualify for the research, respondents had to be from organizations that do at least some business with the EU.
Interviews were conducted online using a rigorous multi-level screening process to ensure that only suitable candidates had the opportunity to participate.
About Veritas Technologies
Veritas Technologies empowers businesses of all sizes to discover the truth in information—their most important digital asset. Using the Veritas platform, customers can accelerate their digital transformation and solve pressing IT and business challenges including multi-cloud data management, data protection, storage optimization, compliance readiness and workload portability—with no cloud vendor lock-in. Eighty-six percent of Fortune 500 companies rely on Veritas today to reveal data insights that drive competitive advantage. Learn more at www.veritas.com or follow us on Twitter at @veritastechllc.