DataGrail Research Reveals 70% of Privacy Professionals Agree Their Systems Will Not Support New Privacy Regulations

Thousands of Manual Processes Increase Risk of Human Error, Strain Productivity; Half of Companies Missed GDPR Compliance Deadline--Most Plan New Hires for Regulations

News provided by

DataGrail

May 16, 2019, 09:00 ET

SAN MATEO, Calif., May 16, 2019 /PRNewswire/ -- DataGrail, the privacy management platform purpose-built for the European (GDPR), Californian (CCPA) and impending privacy regulations, today announced the publication of "The Age of Privacy: The Cost of Continuous Compliance." The report benchmarks the operational impact of the European General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as well as sharing insights into lessons learned and attitudes toward privacy regulations.

"Businesses without a European presence were not impacted by the GDPR. However, with the CCPA fast approaching, US businesses without GDPR are experiencing the same challenges that multinational companies did with GDPR," said Daniel Barber, Co-founder & CEO, DataGrail. "Most companies reported taking at least seven months to achieve GDPR readiness, but now with CCPA only seven months away, they realize their systems will not support CCPA and other forthcoming privacy regulations. Companies will need to integrate and operationalize their privacy management to avoid the time-consuming and error-prone manual processes to comply with these regulations."

DataGrail surveyed more than 300 U.S. privacy management decision makers; including IT, operations, security, legal, and risk and compliance professionals. Key findings from "The Age of Privacy: The Cost of Continuous Compliance" include:

GDPR Compliance Took Longer Than Expected

Only half of companies achieved self-reported compliance before the May 25, 2018 deadline.
Most companies took seven months or longer to achieve readiness.

Even GDPR Readiness is Costly

Two-thirds of companies assigned dozens, or even hundreds, of employees to manage GDPR compliance. Based on survey results, it's likely the average organization spent 2000 - 4000 hours in meetings preparing for GDPR -- more than a full year of work.
Half of privacy management decision makers spent at least 80 hours personally preparing for GDPR, and another 80 hours to sustain compliance -- also a full month of work.

Privacy Rights Requests Are Time-Consuming and Error-Prone

Half of companies use manual processes to manage GDPR privacy rights requests, such as the right to be forgotten.
Two-thirds of companies have processed at least 100 requests in the past year, across dozens of business systems and third-party services, and most of them have at least 25 employees involved in request management. That's thousands of touch points with the potential to introduce human error -- the overwhelming majority of privacy professionals are working to reduce the risk of manual error in these requests.

CCPA Compliance Programs Face the Same Challenges as GDPR Programs

Two-thirds of privacy professionals believe it will take less than six months to prepare for CCPA, even though most reported it took seven months or longer to prepare for GDPR. Even worse, technology adoption rates for CCPA are lower than they were for GDPR -- companies are primarily training employees to manage privacy regulations -- increasing cost and risk of ongoing compliance.

Companies Will Be Challenged by the Future of Privacy Regulations

Most companies are approaching privacy regulations on a case-by-case basis; two-thirds of privacy professionals agree the systems they have put into place will not support new regulations.
90% of companies plan to hire at least three new employees in the next two years to manage privacy regulations, but only one-third of companies are automatically updating their data inventory.

"It is evident from this research that most companies still rely on piecemeal technology solutions and manual processes, when they should be turning to privacy management solutions purpose-built for privacy regulations," said Barber. "As companies turn their attention from GDPR to CCPA and beyond, they must operationalize sustained compliance to reduce risk, provide transparency for their customers, and control operational costs."

Download the "Age of Privacy: The Continuous Cost of Compliance" report

About DataGrail

DataGrail is the first purpose-built privacy management platform that ensures sustained compliance with the GDPR, CCPA, and more. DataGrail directly integrates with more than 100 business systems, such as Salesforce, Adobe, and Oracle, enabling companies to discover and map personal data in seconds--not weeks or even months. DataGrail's direct integrations allow companies to operationalize the privacy request workflow in minutes and unify email preferences across all customer facing applications. Customers include Databricks, G2, and SaaStr. To learn more, please visit datagrail.io or follow DataGrail on Twitter and LinkedIn.

SOURCE DataGrail