New IAPP and TrustArc Report Reveals a Majority of Companies Are Embracing a Single Global Data Protection Strategy

Survey explores differences in data and privacy practices based on company size, location, sector and geographic reach

News provided by

Nov 20, 2019, 09:00 ET

SAN FRANCISCO, Nov. 20, 2019 /PRNewswire/ -- TrustArc, the leader in privacy compliance and data protection solutions, and the International Association of Privacy Professionals (IAPP), the world's largest global information privacy community, today announced the results of new benchmarking research that examines the current state of privacy operations. The research shows that a majority of companies are adopting a single global data protection strategy to manage evolving legal requirements, and that managing the expanding ecosystem of third parties handling data has become a top priority.

"The data outlined in this study demonstrates, once again, that privacy is not a one-off endeavor," said Trevor Hughes, CEO and president of the IAPP. "Privacy management is an increasingly complicated industry. As a result, the role of privacy professionals is taking center stage. Our research highlights how they must act as stewards for implementing the processes and technologies required to ensure scalable compliance across an ever-growing ecosystem of data from partners, customers, and vendors."

Evolving Ecosystem of Partners, Customers, and Vendors Driving Risk Assessment Processes
Vendor and third-party risk assessments ranked first among privacy assessments globally, with 78 percent of U.S. respondents reporting that they now conduct them. That figure indicates the growing complexity of the ecosystem now impacting compliant data privacy management.

"The CCPA will be the toughest privacy law this country has seen to date, expanding the rights of consumers and their data," said Chris Babel, CEO of TrustArc. "This survey reinforces what we continue to see and hear from our thousands of customers: that privacy management is getting more complex. That's why we continue to lead the charge in building the technology solutions and enabling the infrastructure integrations necessary to make compliance automated and scalable."

To understand the different types of privacy operations across regions, company size and industry, TrustArc and the IAPP surveyed close to 350 privacy professionals in the U.S., EU, UK and Canada.

Key findings from the survey include:

U.S. companies comply with more laws than EU counterparts, which focused primarily on GDPR

79% of respondents report complying with two or more privacy laws, while only 16% are focused on just one.
10% report actively working to comply with 50 privacy laws or more at once, while 13% are working on 6-10 laws, and another 13% on 11-49 laws.
EU respondents were more likely to report actively working to comply with five or fewer privacy laws, while U.S. respondents were more likely than their EU counterparts to be complying with 11 or more laws.
Significantly more EU+UK respondents (81%) conduct Data Protection Impact Assessments as compared to U.S. respondents (53%).

Majority pursuing a single, global data protection strategy

56% of respondents across all geographies are working toward a single, global data protection and privacy strategy for data subjects' rights.
Only 28% of U.S. companies and 21% of EU+UK companies categorize data subjects by jurisdiction and geography and handle each data subject's data according to the laws that apply to that individual.
A majority of EU+UK respondents report serving customers in only one region (22%) compared to U.S. respondents (11%).

Growing complexity is driving operational changes to privacy programs

47% updated their website's cookie policy and 80% updated their website's privacy policy one or more times in the last 12 months.
42% deleted personal data more regularly; more so among EU+UK respondents (56%) than U.S. (44%).
21% converted from an opt-out to an opt-in email marketing strategy across geographies; vastly more so in the EU+UK (30%) compared to US respondents (13%).

To download the complete findings, click here.

About the Research
The survey was fielded in the fall of 2019 to the IAPP Daily Dashboard newsletter, which reaches more than 60,000 subscribers from around the globe. The results are based on responses from 327 privacy professionals (primarily in-house in privacy, legal and compliance functions) based in the U.S. (43%), EU/Non-UK (24%), UK (13%), Canada (9%), Asia (4%) and Other Countries (7%). Company size ranged between 1-250 employees (25%), 251-1,000 (17%), 1,001-5,000 (20%), 5,001-25,000 (19%), and 25,000+ (19%). Respondents represent a variety of industries, split between sectors traditionally regulated for privacy (e.g. health care, financial services and banking, insurance) at 35% and sectors traditionally not subject to privacy regulation (e.g. technology and software, manufacturing) at 33%. Those working in legal or consulting services made up 16% of respondents, with another 11% representing governmental or non-profit organizations.

About TrustArc
TrustArc is the leader in privacy compliance and data protection solutions and offers an unmatched combination of innovative technology, services and TRUSTe certification solutions. TrustArc addresses all phases of privacy program management and has been delivering innovative privacy solutions for two-decades to companies across all industries. The TrustArc platform leverages deep privacy expertise and proven methodologies, which have been continuously enhanced through thousands of customer engagements. Headquartered in San Francisco, and backed by a global team across the Americas, Europe, and Asia, TrustArc helps customers worldwide demonstrate compliance, minimize risk and build trust. For additional information visit www.trustarc.com.

About the IAPP
The International Association of Privacy Professionals is the largest and most comprehensive global information privacy community and resource. Founded in 2000, the IAPP is a not-for-profit organization that helps define, support and improve the privacy profession globally. More information about the IAPP is available at iapp.org.

SOURCE TrustArc