The GDPR Report | Chapter 2: Think your organization is ready for the GDPR? Think again…

2017VERITASGDPRREPORT
Chapter 2: Think
your organization isready for the GDPR?
Think again…

The truth in information.
1The GDPR Report | Chapter 2: Think your organization is ready for the GDPR? Think again…

1yr

The one year marker has already passed, with the clock ticking fororganizations to become GDPR compliant. This looming deadline
may not concern many organizations, as 31% of those recently
surveyed think their enterprise is already GDPR compliant. But, it’shighly possible those very organizations are relying on false hopes ora sense of preparedness that is too good to be true.
Experts took time to analyze the results from the 2017 Veritas GDPR
Report to find that only 2% of respondents actually appear to becompliant. Upon closer inspection, worryingly this suggests that infact almost all organizations are not ready, even if almost a third of
those surveyed think that they are today.
The statistics referenced in the remainder of this report are based on
those that stated their organization is already GDPR compliant.

Where areorganizationsgoing wrong?
This report looks tohighlight the vital areas
where organizations whostated they are compliant
still have a lot of work
to do to ensure GDPR
compliance, before May
2018, to avoid the highfines that come with noncompliance.

Fail to prepare,prepare to fail
GDPR requires thatorganizations ensure
appropriate technologicalprotection andorganizational measures
are implemented to be able
to immediately establish if
a personal data breach hastaken place. Yet, almost half(48%) of respondents whostated their organizations
are GDPR compliant admitthat they do not have fullvisibility over identifying
personal data loss
incidents.
Without full visibility, how
can they ensure that abreach is reported to thesupervisory authority
within 72 hours, and informthe individual affectedwithout undue delay – asmandated by GDPR?

The answer is that they
currently can’t. More than
60% of those that say they
are ready for GDPR admitthat it is difficult for theirorganization to identify
and report a personal data
breach within 72 hours.
Failing to do this could
be classified as a major
violation of the regulationand the fines in these cases
are up to 4% of annual
revenue or up to 20 million
EUR.

2

The GDPR Report | Chapter 2: Think your organization is ready for the GDPR? Think again…

Difficulty identifying and reporting a data breach within 72 hours

36%

DifficultNot difficult

61%

I don’t know

3%

Figure 1: “How difficult is it for your organization to identify and report a data breach within 72 hours?”
Showing the results of the 279 respondents who think that their organization is already GDPR compliant

Departing employees
and data theft: astruggle from within
Once an employee leavesan organization their rights
to access company data
are usually withdrawn.
But, incredibly, half (50%)
of respondents who say
their company is compliant
also admit that former
employees can still accesscompany data.

With this type of
uncontrolled access,many organizations areleaving themselves open
to the risk of an attackfrom former employees or,equally as alarming, putting
confidential information in
the hands of people whoshouldn’t have it, which
would infringe on GDPR
compliance. Existing
employees could also be
a risk as organizations

struggle to keep on topof internal threats. As
many as six in ten (60%)
respondents admit that
their organization does
not have full visibility overmonitoring internal threats
to personal data.
It may be assumed thatthreats from existing
employees are low, but
the risk could be higher
amongst former employees.
3The GDPR Report | Chapter 2: Think your organization is ready for the GDPR? Think again…

Their ability to access any
company data must bestopped as soon as theyleave, and ideally restricted
as soon as their noticeis given.

1

The blame game: datastored in the cloud –who is responsible
Cloud use in organizations
is ever increasing. The
vast majority (94%) of
respondents who say thatyrtheir organization is alreadycompliant use hybrid
cloud, where data is stored
both on-premises and ina public or private cloudenvironment. For many ofthese organizations, thedata stored in the cloud willneed to comply with theGDPR. Almost half (49%) of
respondents who say they
are ready for the upcoming
regulation believe that
their organization’s cloudservice provider (CSP) issolely responsible for theGDPR compliance of theirdata stored in the cloud.
But unfortunately, theseorganizations are wrong. Itis the responsibility of theorganization as the data
controller to ensure thatthe data processor (in thisFormer employees of my organization are able to access company data

13%

2%

Agree

50%

Disagree
Neither agree or disagree

35%

I don’t know

Figure 2: “To what extent do you agree or disagree with the following? Former employees of my organization
are able to access company data”
Showing the results of the 279 respondents who think that their organization is already GDPR compliant

4The GDPR Report | Chapter 2: Think your organization is ready for the GDPR? Think again…

case the CSP) provides
sufficient guarantees ofbeing GDPR compliant. Thismeans that both the CSP
and the organization are
responsible for ensuring
data compliance in thecloud. Organizations needto understand that theycannot pass the buck to
the CSP. This false senseof protection could costorganizations millions andlead to permanent branddamage if and whenissues arise.

With a right to forget,
the challenge is set
In January, the EU will belaunching a campaign toinform citizens of their
new rights under theGDPR. This is likely toempower consumers to ask
organizations to remove
all instances of their data,no matter where it isstored. The data could be
stored in a clearly defined
database, but it may also

be duplicated, in an excel
document on the network,or on an employee’s device
for example. Nearly 20%
of respondents who areconfident they are GDPR
compliant also admit that
personal data held within
their organization cannot
be purged or modified.
Not only that, some can’t
search data, don’t know
where it is or do not havedata clearly defined. Morethan one in ten (13%)
respondents admit that
their organization…

• …does not havethe capability toeffectively search
and analyze
personal data
to uncover both
explicit and implicit
references to anindividual• …does not haveaccurate visibility
into where all of
their data is stored• …or, admit that
their organization’sdata sources andrepositories are notclearly definedThis means that manyorganizations will not beable to easily search, findand erase their customers’
data if/when they exercise
their “right to be forgotten”,
which risks a key violationof the GDPR. Organizations
need to ensure that they
can do this for any data
they hold, while at thesame time, minimising thedata that they process,so that it is only used forthe purposes it has beencollected for.
There are many aspects
that organizations need tofirm up to ensure GDPR
compliance. Enabling theorganization to identify
and respond to a breach
immediately, ensuring thatformer employees cannot
access company data,retaining responsibility
for data held within thecloud and being able toreact to requests to beforgotten are just a handfulof examples of whereorganizations need to makedrastic improvements tobecome GDPR-ready.

For information on how Veritas Technologies can help yourorganization become GDPR compliant visit:

veritas.com/gdpr5

The GDPR Report | Chapter 2: Think your organization is ready for the GDPR? Think again…

Methodology
Veritas commissioned independent
technology market research
specialist Vanson Bourne toundertake the research upon which
this report is based.
A total of 900 business decision
makers were interviewed in February
and March 2017 across the US,
the UK, France, Germany, Australia,
Singapore, Japan and the Republicof Korea. The respondents were fromorganizations with at least 1,000
employees, and could be from any
sector. To qualify for the research,
respondents had to be fromorganizations who do at least somebusiness within the EU.
Interviews were conducted
online using a rigorous multi-levelscreening process to ensure that
only suitable candidates had theopportunity to participate.

The truth in information.
6