in 2019. That study is not restricted to companies complying with the GDPR alone, but surveys companies across the world, including many in the United States. Research conducted by the Ponemon Institute in 2019 on behalf of international law firm McDermott Will & Emery (MW&E) focused on GDPR compliance found substantially higher figures: an average 2019 budget of $13.6 million for GDPR activities, a slight increase from $13.2 million in 2018.<sup>69</sup> The different results suggest the great variation in expenditures for compliance, depending on firm size, industry, types of activities, geography, perceived risks of operations, and risk tolerance. For the very large companies that make up the FTSE 100 stock index, estimates for GDPR compliance for 2018 range from an average of $84 million for banks, $26 million for technology and telecommunications firms, to $6 million for industrial goods and services firms.<sup>70</sup> A high percentage of the costs (between a fifth and a half, depending on the study) are associated with hiring of privacy compliance personnel. Technology also accounts for a significant portion (between 12 to 17 percent, depending on study) of GDPR privacy expenses. Outside consultants and lawyers accounted for another 19 to 24 percent, again depending on the study. One study concluded that GDPR compliance required extensive person-hours in meetings; DataGrail estimates that the average company spent 2,100 hours in GDPR preparation meetings and that enterprises staffed with 1,000 or more employees could have spent over 9,000 hours in such meetings.<sup>71</sup> Notably, despite these expenditures, most respondents (62% in the IAPP/EY study) believed their privacy budget was insufficient to meet their data protection obligations.<sup>72</sup> The IAPP/EY study surveyed 370 respondents predominately composed of organizations headquartered in the U.S. (39%), European Union (33%), and United Kingdom (13%). Company size ranged from under 100 to over 75,000 employees and industry sectors represented included tech, finance, health care, government, and consulting services.<sup>73</sup> The salaries and benefits of an organization’s privacy team constituted the majority of privacy spending, on average receiving $397,100, combined technology expenditures followed behind receiving an average mean privacy spend of $172,000.<sup>74</sup> Privacy expenditures are higher for organizations with more employees: organizations with 5,000 or fewer employees were estimated to have a mean privacy expenditure of $257,000 in 2019 whereas organizations with 75,000 or more employees had an estimated mean privacy expenditure of $1,883,200.<sup>75</sup>

**Mean 2019 Estimated Privacy Spend Reported to IAPP by Employee Size, U.S. Dollars**<sup>76</sup>

||**<5K**<br>**Employees**|**5K-24.9K**<br>**Employees**|**25K-74.9K**<br>**Employees**|**75K**<br>**+**<br>**Employees**|
|---|---|---|---|---|
|**Privacy Team**|$170,700|$581,800|$744,200|$847,100|
|**Salaries**|||||
|**Privacy Team**<br>**Technologies**|$23,500|$47,100|$39,700|$115,600|

> 69 _Id._ at 27.

> 70 Joseph Johnson, _GDPR Implementation Costs for FTSE100 Companies in the United Kingdom 2018 By Sector_ (Statista 2018). Currency conversion from British pounds using XE.

> 71 _Id._

> 72 _Id._ at 37.

> 73 _Id._ at viii, xi.

> 74 _Id._ at 28.

> 75 _Id._ at 30.

> 76 _Id._

12