Top GDPR compliance risks: Breach notification, data mapping, managing consent

The International Association of Privacy Professionals (IAPP) conducted a survey that gauges the perceived risks among privacy professionals of not complying with various aspects of the General Data Protection Regulation (GDPR).

Surveying close to 500 privacy professionals split evenly between the U.S. and EU, the top GDPR compliance risks are failure to: comply with the new 72-hour data breach notification regulation, map data flows, obtain user consent, and manage international data transfers.

With less than seven months to comply with the GDPR, the most sweeping change to data protection in decades, companies all over the world are determining how to best adjust their internal systems and processes in order to address increasingly strict compliance requirements. The risks of not complying with the GDPR include fines up to 20 million Euros or four percent of global turnover, whichever is higher.

“As today’s organizations increasingly rely on data to drive their businesses forward, the challenge of protecting and managing that data is intensifying at the same rate,” said Trevor Hughes, CEO of IAPP. “This survey reflects privacy professionals’ views on complying with new privacy regulations like the GDPR, and gives us a better understanding of how companies are preparing and how as an industry we can best support them.”

The survey asked respondents to rank perceived risk on a five point scale (1 = no risk, 5 = high risk) for a series of GDPR requirements and the top four areas of compliance risk are:

• GDPR 72-hour breach notification. Overall Risk Score = 3.66
• Data inventory and mapping. Overall Risk Score = 3.57. While data mapping is not an explicit requirement of the GDPR, it provides critical information used to achieve compliance – examples include what type of data is collected, how data is used, and retention policies
• User consent. Overall Risk Score = 3.54
• International data transfer. Overall Risk Score = 3.54.

Survey findings indicate differences in confidence among U.S. and European privacy professionals regarding their ability to meet the GDPR deadline. U.S. respondents are more bullish with 84% saying they will hit the mark by May 25, 2018, while 72% of European privacy professionals state they will be ready in time.

In terms of barriers to compliance, U.S. firms cite the complexity of GDPR requirements as the largest hurdle, while EU firms cite lack of appropriate budget.

Regardless of confidence levels, all respondents agree that the number one way to mitigate GDPR compliance risk is privacy training followed closely by investments in privacy and data protection technology such as data mapping tools.