GDPR Countdown

When did your company become aware of the General Data Protection Regulation and the need to do something about it?

GDPR has been a running story in DataIQ since it launched in 2011, through the 3,000-plus amendments and four years it took to become law and now in the final few months running up to enforcement.

With the first GDPR Impact research in 2016, 46.0% of businesses said they were very aware of the new data protection law. One year later, however, this figure was stuck at nearly the same level (50.0%).

Yet the last 12 months seem to have been decisive with a dramatic rise in this number to 84.3%.

Compliance is hard won and Never Certain

If this had not happened so close to the enforcement regime starting, it would have been a cause for concern. Companies need to look deeply into their data-driven processes, data management and data governance policies.

What they find is not always easy to resolve, which may explain that only 25.4% describe themselves as very prepared for GDPR.

Compliance is hard won and never certain, so it is understandable if 61.0% describe themselves as somewhat prepared.

With much guidance still pending and legal opinion either conflicting or so risk averse as to make existing business practices often look impossible to bring into line, it is better to adopt a cautious view.

But that is only if the Regulation is viewed from a purely compliance point of view. It certainly merits a legally-oriented perspective at the outset of any programme. Unless those strictures are closely considered and mapped against the operating model of the business, it will be difficult to spot the gaps in which risk might arise.

Ticking the box of compliance should not be the end-point, however. Whatever the letter of the law, GDPR is also a major opportunity to reset the relationship with customers and get ahead of any concerns they might have about data sharing, security and control.

This is why maturity in the adoption of data and analytics becomes a strong indicator of whether the underlying culture of an organisation has evolved or if it is just trying to stay within the parameters set out by the Regulation. In this perspective, there seems to be a positive correlation between preparing for GDPR and data ratification of the business.

Back in 2016, just 39% described themselves as in the upper two quintiles of maturity (Managed and Optimised). This year, the number has risen to 62.7%, meaning the majority of UK companies are putting data and analytics at the heart of how they operate. That is likely to mean they will realise commercial benefits from their compliance efforts, not just risk mitigation.

“It comes down to knowing how and where to focus training and measurement, rather than system fixes.”

So how can your company find out whether it is heading towards both compliance and value-adding data maturity? One way is to carry out a capability audit, like DQM GRC’s RADAR.

As technical director Peter Galdies explains, “this involves a real inspection of practice and process to understand the business thinking and highlight where business process needs to be re-engineered. Often, this comes down to knowing how and where to focus training and measurement, rather than system fixes.”

While it is tempting to believe that organisations only need to assess their compliance with GDPR once, the reality is very different, he warns.

“The law itself requires that the organisation be capable of continually demonstrating its compliance, and if you are the kind of organisation that needs a Data Protection Officer, then a key part of that role is to audit or assess that compliance.”

In fact, when it comes to implementation, the GDPR river runs very deep indeed. The cultural and system changes expected by the legislators cannot be fixed by technology or training alone and require a process of continual self-inspection. This is inherent in the expected behaviours of “privacy by design” and “data protection by default” which the regulators demand of organisations under the GDPR regime.

“To effectively understand your organisation’s ability to comply both today and, importantly, in the future, a robust assessment process (like our GDPR Radar) has to examine not only if you have the right controls, but also if you have the right management systems in place around those controls to ensure they will still be working for you going forwards,” says Galdies.

“That means measuring the maturity of your compliance processes, not just ticking boxes.”

Evidence gained from a data audit of this type provides a powerful basis on which to explain to the board what more might need to be done, above and beyond any box-ticking for compliance purposes.

It is also a useful demonstration of accountability to prove that you are reaching for compliance, too. And hitting two birds with one stone is always a real sign of advanced abilities.

To contact the GDPR Advisory Board please visit:  www.gdpr-board.co.uk

DataIQ

You Might Also Read:

GDPR - Questions & Answers:

« AI And Blockchain In A Disruptive World
Six Steps to Protect Customer Data »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Tendo Solutions

Tendo Solutions

Tendo Solutions provides intelligence, security, forensics and risk solutions to clients across different sectors and jurisdictions.

SERMA Safety & Security (S3)

SERMA Safety & Security (S3)

SERMA Safety & Security provides a comprehensive cybersecurity offering incorporating Expertise, Evaluation, Consultancy and Training, covering hardware, software and information systems.

Delta Risk

Delta Risk

Delta Risk is a global provider of managed security services and cyber security risk management solutions to government and private sector clients.

Department of Energy - Cybersecurity, Energy Security, and Emergency Response (CESER)

Department of Energy - Cybersecurity, Energy Security, and Emergency Response (CESER)

The Office of Cybersecurity, Energy Security, and Emergency Response (CESER) addresses the emerging threats of tomorrow while protecting the reliable flow of energy to Americans today.

Verifi

Verifi

Verifi is an award-winning provider of end-to-end payment protection and risk management solutions.

Infopulse

Infopulse

Infopulse is a global provider of Software Engineering, Cloud & IT Infrastructure Management, and Cybersecurity services.

Gradcracker

Gradcracker

Gradcracker is THE careers website for Science, Technology (including Cybersecurity), Engineering and Maths university students in the UK.

Department of Justice & Equality - Cybercrime Division

Department of Justice & Equality - Cybercrime Division

The Cybercrime division is responsible for developing policy in relation to the criminal activity and coordinating a range of different cyber initiatives at national and international level.

GK8

GK8

GK8 is a cyber security company that offers a high security custodian technology for managing and safeguarding digital assets. Secure, Compliant and Practical.

Get Indemnity

Get Indemnity

Get Indemnity are specialist insurance brokers with experience working on a wide range of innovative business insurance products that combine risk management, indemnity and incident response services.

Wontok

Wontok

Wontok deliver innovative value-added data security services that fill the gaps left in traditional security solutions.

CyberCyte

CyberCyte

CyberCyte provides a disruptive built-in integrated physical, network and perimeter security solution framework.

Smoothstack

Smoothstack

Smoothstack is a technology talent incubator whose immersive training program kick starts IT careers and delivers a fresh source of IT talent.

GISEC Global

GISEC Global

GISEC Global provides vendors and companies from around the world with access to lucrative opportunity to capitalize on what's set to become one of the world's booming markets.

Cyro Cyber

Cyro Cyber

Cyro Cyber is a collective of some of the UK’s most experienced and savvy cybersecurity, information assurance, data protection, IT governance and compliance experts.

Cytracom

Cytracom

Cytracom delivers powerful yet intuitive solutions that enable MSPs and ITSPs to meet the challenges of security, compliance, and connectivity.