## 5 Governance and Policy on Data Protection
It also highlights the need to create procedures in place in order to make sure systems are up-to-date, and that hardware and software are monitored according to Cybersecurity standards set by government bodies in line with policies and procedures of the individual countries. The Department of Digital, Culture, Media and Sport of the UK carried out a survey to collect data on Cybersecurity Breaches Survey 2019 covering 2018 and 2019, respectively [23]. This was a government initiative, and the survey that was carried out was to see how GDPR and Cybersecurity plans had made a difference to businesses and charities sectors. An extract from the report, as shown in Figure 1 below, shows the relevance of GDPR and how its effects have shown the reduction in breaches over the course of the two years. Figure 1 shows the experience of breaches or attacks and the difference GDPR and Cybersecurity have made within organisations between 2018 and 2019. Figure 1 above also shows that 32% of businesses identified cybersecurity breaches or attacks in the last 12 months. It also explains the GBP 4180 was the average annual cost for businesses that lost data or assets after breaches. The report went on to further show that amongst the 32% that suffered these breaches, 32% needed new measures to prevent future attacks, 27% took up staff time dealing with breaches or attacks, 19% had staff stopped from carrying out their daily work and 48% identified at least one breach or attack a month. Figure 2 below shows the impact of the UK government's initiative of General Data Protection Regulation (GDPR) and the Information Commissioners Office (ICO), government official organisation contributed to the reduction in these breaches compared from 2018 and 2019. The statistics above in Figure 2 show that 30% of businesses made changes to their cybersecurity because of GDPR. From those companies, 60% implemented new policies, 15% had extra staff training or communications, 11% changed their firewall or systems configurations, and 6% created new contingency plans if they had another cyber-attack. The year 2019 showed an increase in cybersecurity policies in place after GDPR was initiated through the government initiative. GDPR certainly gave businesses the platform to conform to standards and the ability to understand what protection was required to keep their data safe. This report showed that in 2019, more businesses than before had taken positive steps to improve their cybersecurity. This is in part linked to the introduction of GDPR. Another importance of security and its best practices within SMEs and bigger organisations, is its compliance to varying standards and practices. Such examples are Cyber Essentials, Cyber Essentials Plus and International Standard for Information Security as referred to as ISO27001 and ISO27701, all of which give companies a means to protect and comply with the laws [23]. The SME in this paper complies with the UK rules and must observe the renewal of its certification every year to show its customers that it complies  
Figure 1: Cybersecurity Breach Survey 2019, Department of Digital, Culture, Media, and Sports UK [23]. Figure 2: GDPR and Cybersecurity [23]. with GDPR and UK standards. These best practices enable businesses to protect their assets and comply with UK laws and regulations. A conference paper by [PERSON], [PERSON] et al. (2020) showed how developed countries had created standards and implemented policies compared to developing nations. It was concluded that without a national strategy and responsibility at senior level authority, all cybersecurity activities were limited and deficient unless brought up to international standards [24]. Countries like the UK and other EU nations have a more consistent approach to cybersecurity and international cooperation in cybersecurity matters. Another example was the Netherlands, through their National Cybersecurity Council collaborating with other countries to strengthen its international orientation. [PERSON] et al.