Complex regulations and sophisticated cyberattacks inflate non-compliance costs

The cost of non-compliance has significantly increased over the past few years, and the issue could grow more serious. 90 percent of organizations believe that compliance with the GDPR would be difficult to achieve, according to a new study conducted by the Ponemon Institute.

GDPR is considered by respondents to be the most challenging among other data compliance regulations such as Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Act (GLBA) and Federal Information Security Management Act (FISMA).

Key findings

• The average cost of compliance increased 43 percent from 2011, and totals around $5.47 million annually. However, the average cost of non-compliance increased 45 percent from 2011, and adds up to $14.82 million annually.
• Non-compliance costs 2.71 times the cost of maintaining or meeting compliance requirements. Non-compliance costs come from the costs associated with business disruption, productivity losses, fines, penalties, and settlement costs, among others.
• The cost of compliance can vary by industry: media organizations average $7.7 million annually to comply with regulations and policies, while financial services companies face more than $30.9 million annually in compliance costs. These costs widely vary based on the amount of sensitive or confidential information a particular industry handles and is required to secure.
• Among the individual regulations, survey respondents found that GDPR is the most difficult to achieve compliance, even though enforcement for GDPR doesn’t start until May 25, 2018. 90 percent of respondents felt that GDPR would be difficult, while only 55 percent felt that the Payment Card Industry Data Security Standard (PCI-DSS) was a challenge, the second highest amongst all regulations.
• Companies are not spending enough on maintaining or meeting compliance, as it only accounts for an average of 14.3 percent of the IT department’s budget.

Data protection regulations are increasingly complex in nature, due to the increased value and sensitivity of personal or proprietary data. As data becomes more valuable, the risk of data breaches, data loss, cyberattacks or insider threats becomes a grave and urgent issue.

The enforcement of regulations like GDPR demonstrates the new era of complex policies developed to protect data at an individual level from increasingly sophisticated cyberattacks. More data protection regulations and frameworks like the EU’s GDPR are expected to be developed and implemented from other areas of the world, including China and Australia.

“It’s not surprising that the overall cost of compliance has risen so drastically over the past six years. Data is a precious commodity for individual consumers and multinational organizations alike. And the threat posed by cyberattacks is only growing exponentially. Understanding where your data travels, resides, and how to best protect it is no longer an option for companies, especially as their businesses’ livelihood is also at stake. Organizations have a responsibility to their customers, partners and vendors to protect data, which also means being constantly vigilant with compliance mandates or regulations such as GDPR or PCI DSS,” said Peter Merkulov, CTO at Globalscape.

Source of compliance costs

To meet compliance mandates, organizations employ a number of methods that can factor into the total cost. These could include administration overhead, consultant services, training, and communication and technology, among others. Data security has the highest average compliance cost for organizations, averaging $2 million a year.

When looking at the top three technologies already in use to maintain compliance, of the companies surveyed, organizations annually spend around $1.34 million on compliance-related platforms, $1 million on incident response, and $750,000 on audit and assessments. This investment does ultimately pay off, according to the results, as companies conducting regular audits had a reduced overall compliance cost. More than two audits a year can significantly reduce this cost: companies might find themselves paying $14 million if they run more than two audits versus $27 million for one or two audits a year.

Breaking down non-compliance expenses

The report also shows that companies are not spending nearly enough on compliance, and therefore the costs associated with non-compliance are 2.71 times higher. While the average annual cost of non-compliance is $14.82 million, the range could be anywhere from $2.2 million to $39.22 million.

An organization’s security posture can also vastly increase or decrease the cost of compliance or non-compliance. Even established regulations such as HIPAA or PCI-DSS now include requirements specific to data security or data breach responses. Organizations that do not have an effective or strong security ecosystem in place face up to an average of $25 million in annual costs to meet compliance.

Organizations that implement centralized data governance also stand to save the most, as they could reduce their compliance costs by $3 million.