With the General Data Protection Regulation (GDPR) taking effect on the 25th May 2018, organisations around the globe should be preparing accordingly. However, a survey by Trend Micro found that C-suite executives are not approaching the regulation with the seriousness required, resulting in overconfidence when it comes to compliance.
The research reveals a robust awareness of the principles behind GDPR, with a strong 95% of business leaders knowing they need to comply with the regulation, and 85% having reviewed its requirements. In addition, 79% of businesses are confident that their data is as secure as it can possibly be.
Despite this perceived awareness, there is some confusion as to exactly what Personally Identifiable Information (PII) needs to be protected. Of those surveyed, 64% were unaware that a customer’s date of birth constitutes as PII. Additionally, 42% wouldn’t classify email marketing databases as PII, 32% don’t consider physical addresses, and 21% don’t see a customer’s email address as PII. These results indicate that businesses are not as prepared, or secure, as they believe themselves to be. Regardless, this data provides hackers with all they need to commit identity theft, and any business not properly protecting this information is at risk of a penalty fine.
According to the survey, a staggering 66% of respondents appear to be dismissive of the amount they could be fined without the required security protections in place. Only 33% recognize that up to 4% of their annual turnover could be sacrificed. Additionally, 66% of businesses believe reputation and brand equity damage is the biggest pitfall in the event of a breach, with 46% of respondents claiming this would have the largest affect amongst existing customers. These attitudes are especially alarming considering businesses could be shut down in the event of a breach.
“Investing in state of the art equipment and employing data protection policies should be seen as a wise business practice, not an operational burden,” said Rik Ferguson, vice president of security research for Trend Micro. “As a strategic security partner, we see it as our shared responsibility to help customers meet GDPR data security compliance.”
Trend Micro also learned that businesses are uncertain as to who is held accountable for the loss of EU data by a US service provider. Only 14% could correctly identify that the loss of data is the responsibility of both parties, 51% believing the fine goes to the EU data owner, while 24% think the US service provider is at fault.
In addition, it turns out businesses aren’t sure who should take ownership of ensuring compliance with the regulation, either. Of those surveyed, 31% believe the CEO is responsible for leading GDPR compliance, whereas 27% think the CISO and their security team should take the lead. However, only 21% of those businesses actually have a senior executive involved in the GDPR process. Meanwhile, 65% have the IT department taking the lead, while only 22% have a board level or management member involved.
With threats growing in sophistication, businesses often lack the expertise to combat them, and layered data protection technology is required. GDPR mandates that businesses must implement state-of-the-art technologies relative to the risks faced. Despite this, only 34% of businesses have implemented advanced capabilities to identify intruders, 33% have invested in data leak prevention technology and 31% have employed encryption technologies.