A recent survey has revealed that companies and organisations are finding it difficult to meet this month’s deadline for GDPR compliance, risking potentially devastating fines from the Information Commissioners Office.

Approved by the EU Parliament in 2016, GDPR will ensure greater transparency in the handling of consumer data and offer EU citizens some of the best privacy rights anywhere on earth. If firms fail to comply with the regulations they could be fined up to €20 million or 4% of annual turnover. With under a month to go until GDPR implementation, the survey by the British Standards Institute (BSI) raises serious questions on how firms will look to comply.

Compliance Issues

BSI surveyed 1,800 firms, however despite 97% agreeing that regulation would affect them, only 5% were fully prepared and 33% were halfway to complying with GDPR. Participants of the survey highlighted confusion as a key problem when working toward GDPR compliance; some claimed they do not fully understand some of the requirements of the legislation.

40% of participants claimed they were unaware that carrying out privacy impact assessments is a key factor in achieving compliance. Additionally, 88% said they lacked the relevant knowledge in this particular area. This is a point of serious concern, as Privacy Impact Assessments are a key requirement of GDPR. These risk-based assessments are used to ensure that citizens’ rights and freedoms are protected when their data is processed.

GDPR regulation focuses heavily on the data rights of citizens, and so firms must view PIA’s as a priority.

Survey respondents were from a broad variety of sectors, including:

• Aerospace & Defence
• Energy
• Education
• Healthcare
• Manufacturing
• Transportation & Distribution

Stephen O’Boyle, Head of Professional Services at BSI, believes that many organisations find GDPR compliance more complicated than it should be, and this could be the reasoning behind such poor levels of readiness.

He said: “There’s a lot of talk surrounding the GDPR but with less than one month to go our research shows that organisations are still unprepared and don’t fully understand what’s required of them.

“Becoming GDPR ready is less complicated, less expensive and less daunting than many businesses think.”

Individual Responsibility

Research by BSI also underlined concerns surrounding employees understanding of upcoming EU regulations. Over half of organisations surveyed claimed they had concerns regarding the role of their employees in GDPR compliance and one in five said they had experienced data compromising incidents within the last year.

The Data Protection Commissioner also reported that over 2,700 data security breaches occurred in 2017 – This is a startling 26% increase from 2016.

Individual responsibility is a key factor in the day-to-day security of any modern organisation, and the need for stringent cyber hygiene cannot be understated. This survey shows that companies are not only letting down their employees by failing to adequately inform them on the issues that could arise in the future, but also letting down consumers.

The survey also highlights a lack of engagement by management structures in a number of firms; only one in five senior managers are said to be actively engaged with GDPR compliance.

Leading the Way

Details surrounding the lengths some companies are going to in order to meet GDPR compliance have emerged in recent months. Google is said to have spent over 18 months preparing for GDPR readiness, spending millions in the process. The Department of Work and Pensions (DWP) is also said to be on-course to spend almost £15 million on staff training and system overhauls in order to comply with the regulation.

Although the survey highlights concerns among companies and organisations struggling to keep pace with the looming deadline, there are signs that firms are taking this very seriously.