9 in 10 Companies Have Started to Address Massive Changes Mandated by New EU Privacy Law

BRUSSELS, Nov. 9, 2016 /PRNewswire/ -- Results from the IAPP / TRUSTe GDPR Privacy Benchmarking Study provide insight into how companies are preparing for the sweeping changes to privacy laws under the EU General Data Protection Regulation (GDPR). The study profiled companies on overall preparations for the GDPR, along with actions taken on key components including assigning a Data Protection Officer, understanding where and how personal data is used within their organization, and conducting Data Privacy Impact Assessments.    

Key Takeaways

• 9 in10 companies have actively begun to address the regulation, including 43% who have a plan in place and 49% who have started implementing their GDPR compliance plan. 
• EU companies are further along the compliance path with 67% reporting their implementation is underway or completed vs. 42% for the US.
• Privacy Assessments and Data Mapping projects are conducted with a mix of technology tools plus manual processes like email and spreadsheets.

GDPR Overview

The GDPR overhauls the data privacy legal requirements for companies operating in the EU, including companies based outside the EU that have customers or employees located there. The regulation, put into effect in May 2016, mandates companies comply with a broad range of items by May 2018, including requirements to conduct Data Privacy Impact Assessments (PIAs / DPIAs) for high risk processing, designate a Data Protection Officer (DPO), and demonstrate their privacy program meets all elements of the 200 page regulation. The regulation includes stiff penalties, which can equal 4% of annual sales.

Data Protection Officers (DPOs)

The Data Protection Officer, who may create the strategy and manage ongoing compliance for a company, appears to be a high priority with 68% of respondents either having a DPO in place (46%), or having plans to appoint an internal resource to the role (22%).   

"Clearly, IAPP members are taking the GDPR's DPO requirement seriously, with many of them well on their way toward creating a GDPR compliance program," said IAPP President and CEO J. Trevor Hughes, CIPP. "As the research shows, privacy program leaders are resourceful, but increasingly pressed for time and resources. The IAPP's training and in-depth educational materials, alongside tools developed by technology providers like TRUSTe, will be vital for helping organizations be ready for the GDPR in May of 2018."

Data Inventory and Mapping

Data Inventory and Mapping, which helps an organization understand where all of the privacy sensitive information is located in the organization, is often considered one of the first and most important steps to complete in order to understand where to focus resources. 

• 43% of companies report they already conduct data inventory and mapping projects, and another 30% are planning to do so in the next 12 months. 

Some of the top challenges include lack of internal resources (58%) and being too busy on other priorities (32%), which is consistent with the research indicating 62% rely on manual tools including email and spreadsheets. Data inventory projects are characterized by a high degree of cross functional collaboration, with 70% reporting they work with IT and 62% with Information Security to complete the projects. 49% also reported the projects are either solely or partially (along with privacy) funded from the IT / Security / Compliance budgets – while 19% reported the projects are solely funded from the privacy budget.

Data Privacy Impact Assessments (DPIAs / PIAs)

• 71% of organizations are currently conducting Data Privacy Impact Assessments. 

Some of the top challenges include lack of time (56%) and tools (37%), consistent with data showing 66% rely on spreadsheets and email. Companies are also using technology tools with 59% reporting they use either external software tools or an internally developed system to assist with these projects. The frequency of assessments varies widely – from as few as 1-2 to as many as 1,000+ per year. The time investment also varies widely, ranging from 25% taking less than one week to 15% taking longer than a month. 

TRUSTe CEO Chris Babel states "the clock is ticking and many companies are well on their way to achieving GDPR compliance. This is encouraging since many companies have reported it could take several quarters or more along with investments in additional resources, process changes, and technology tools to achieve compliance. The research suggests many companies are relying on antiquated tools and they will likely either need to ramp up their staff, or begin to embrace technology solutions to improve productivity in order to maintain compliance on an ongoing basis."

Research Methodology

The IAPP emailed an online survey to IAPP members and others who receive the IAPP's Daily Dashboard email newsletter, which provides privacy and data protection news. The 244 respondents who completed the entire survey primarily represent organizations in the United States (40%) and the European Union (35%), with a few respondents from Canada (13 percent) and other jurisdictions. Organizations of all sizes are also evenly represented in the survey with the largest organizations (more than 25,000 employees) submitting around 28 percent of the responses, companies with either 1,000-5,000 employees or 5,001-25,000 employees each comprising 20 percent, and companies under 1,000 sharing the remaining 28 percent of responses. Respondents reflect a wide variety of industries as well, including around 13 percent from software and services, 12 percent from government offices, and 9 percent working in health care.

About IAPP

The International Association of Privacy Professionals is the world's largest association of privacy professionals with more than 25,000 members across 83 countries. The IAPP is a not-for-profit association that helps to define and support the privacy profession globally. More information about the IAPP is available at www.iapp.org.

About TRUSTe

TRUSTe powers privacy compliance and risk management with comprehensive technology, consulting and certification solutions. We have nearly 20 years' experience across all industries and a team of more than 150 professionals developing innovative solutions to address global regulatory and data protection requirements that govern the use of customer and employee information. Our award winning Data Privacy Management Platform addresses all phases of privacy management including program development, data inventory, risk assessments, monitoring, and compliance reporting. Companies worldwide rely on TRUSTe to demonstrate compliance, minimize risk, and build trust. More information about TRUSTe is available at www.truste.com.

SOURCE TRUSTe

Related Links

http://www.truste.com