Survey Reveals Biggest GDPR Compliance Risks are Breach Notification, Data Mapping, Managing Consent, and Data Transfer
New IAPP and TrustArc research uncovers perceptions of compliance risk and strategies to mitigate in U.S. and EU
BRUSSELS, November 8, 2017 – IAPP Europe Data Protection Congress 2017 – TrustArc, the data privacy management company, today announced the results of a joint survey with the International Association of Privacy Professionals (IAPP) that gauges the perceived risks among privacy professionals of not complying with various aspects of the European Union’s General Data Protection Regulation (GDPR). Surveying close to 500 privacy professionals split evenly between the U.S. and EU, the top GDPR compliance risks are failure to: comply with the new 72-hour data breach notification regulation, map data flows, obtain user consent, and manage international data transfers. The results of the survey were released during the IAPP Europe Data Protection Congress in Brussels, Belgium.
“The results of the IAPP survey on the risks of GDPR compliance shines a light on the challenges of implementing effective data protection in general, let alone when you face a looming deadline,” said Chris Babel, CEO of TrustArc. “Working with our customers, we find that the most effective strategy to achieve compliance is based on building employee expertise and know-how, combined with technology platforms that enable the next-generation processes and routines necessary to efficiently do things like identify and map user data and manage user consent.”
With less than seven months to comply with the GDPR, the most sweeping change to data protection in decades, companies all over the world are determining how to best adjust their internal systems and processes in order to address increasingly strict compliance requirements. The risks of not complying with the GDPR include fines up to 20 million Euros or four percent of global turnover, whichever is higher.
“As today’s organizations increasingly rely on data to drive their businesses forward, the challenge of protecting and managing that data is intensifying at the same rate,” said Trevor Hughes, CEO of IAPP. “This survey reflects privacy professionals’ views on complying with new privacy regulations like the GDPR, and gives us a better understanding of how companies are preparing and how as an industry we can best support them.”
The survey asked respondents to rank perceived risk on a five point scale (1 = no risk, 5 = high risk) for a series of GDPR requirements and the top four areas of compliance risk are:
- GDPR 72-hour breach notification. Overall Risk Score = 3.66
- Data inventory and mapping. Overall Risk Score = 3.57
While data mapping is not an explicit requirement of the GDPR, it provides critical information used to achieve compliance – examples include what type of data is collected, how data is used, and retention policies.
- User consent. Overall Risk Score = 3.54
- International data transfer. Overall Risk Score = 3.54
Survey findings indicate differences in confidence among U.S. and European privacy professionals regarding their ability to meet the GDPR deadline. U.S. respondents are more bullish with 84% saying they will hit the mark by May 25, 2018, while 72% of European privacy professionals state they will be ready in time.
In terms of barriers to compliance, U.S. firms cite the complexity of GDPR requirements as the largest hurdle, while EU firms cite lack of appropriate budget.
Regardless of confidence levels, all respondents agree that the number one way to mitigate GDPR compliance risk is privacy training followed closely by investments in privacy and data protection technology such as data mapping tools.
About TrustArc
TrustArc powers privacy compliance and risk management with integrated technology, consulting and TRUSTe certification solutions – addressing all phases of privacy program management. The foundation for our solutions is the TrustArc Privacy Platform which provides a flexible, scalable, and secure way to manage privacy. Our technology platform, fortified through six years of operating experience across a wide range of industries and client use cases, along with our services, leverage deep privacy expertise and proven methodologies which we have continuously enhanced through thousands of client projects over the past two decades. Headquartered in San Francisco, and backed by a global team, we help over 1,000 clients worldwide demonstrate compliance, minimize risk, and build trust. For more information, visit www.trustarc.com.
