GDPR came into effect on 25th May 2018, but how has it affected businesses since it was implemented?
During the run up to its implementation, the abbreviated term, “GDPR” almost became a taboo subject. Some business professionals were simply fed up of hearing about it or wanted to ignore it completely, whereas others were scared for what it might mean and confused about how it might affect them.
A great deal of large companies hired consultants and specialised organisation to help them become GDPR ready, whereas smaller companies were able to simply make a few tweaks in their business processes and the way they held data. However, a year on and very little is now spoken about it. GDPR has become part and parcel of business. We’re aware of it and most businesses are careful to ensure they’re compliant when on-boarding new clients, altering suppliers, updating software and reviewing processes.
According to an independent study conducted by USBMakers.com, 42.5% of respondents audited their data processes on the run up to GDPR, while only 16.8% appointed a data protection officer.
As explained on ITGovernance.co.uk, Under the GDPR, appointing a DPO is mandatory under three circumstances:
- The organisation is a public authority or body.
- The organisation’s core activities consist of data processing operations that require regular and systematic monitoring of data subjects on a large scale.
- The organisation’s core activities consist of large-scale processing of special categories of data (sensitive data such as personal information on health, religion, race or sexual orientation) and/or personal data relating to criminal convictions and offences.
Have there been many breaches?
The ICO recorded a distinct rise in data protection complaints following the implementation of GDPR, receiving 6,281 complaints in just five weeks. This shows just how serious people are about the security of their data.
Since this time and according to the law firm DLA Piper, European businesses have reported 59,000 data breaches. The UK reported the third highest number of breaches, amounting to 10,600, while the Netherlands reported the most.
One of the highest-profile breaches was through British Airways, whereby 244,000 payments cards are thought to have been compromised.
What has GDPR cost businesses?
This is a tough one. In preparation for GDPR big businesses spent almost £1 billion, which is understandable since those who’re not compliant are liable to fines of up to 4% of their annual global turnover.
So far, European data protection agencies have issued 91 fines for GDPR breaches totalling €56m with Google receiving the highest fine of €50 million.
As explained on theregister.co.uk, “An assessment from the European Data Protection Board (EDPB), which is made up of regulators across the region, found that, in the first nine months, there were 206,326 cases reported under the new law from the supervisory authorities in the 31 countries in the European Economic Area.”
Around 65,000 of these were reported by a data controller, while about 95,000 were complaints. Half of these cases have already been closed.
What more can businesses do?
What’s surprising is that 30.2% of the USB Makers survey respondents did not know whether they’d been hacked and are therefore open to potential risks. What’s more, many still use paper, hard drives and local desktops to store data. Only 28% use the cloud.
It appears as though many businesses are complying to the rules when it comes to managing their data more effectively, however, there is still room for improvement. People are often the greatest risks to data breaches, so a greater understanding of the rules and regulations is still required. Along with this, businesses can increase security measures and ensure the appointment of DPOs.
The number of complaints and reports will only continue to rise as data protection agencies scale up their enquiries and have increased resources available to them. It’s for this reason that businesses should consider reviewing their compliance on a regular basis, ensuring all staff, current and new are up to date with the latest news and information.
