GDPR Compliance Deadline Around the Corner. Is Your Organization Prepared?

If you are a business owner anywhere in the world, do business within the European Union, and you love regulation, there is some great news coming your way. New requirements for such organizations are set to take effect in May of 2018. This may seem far away, but really is just around the bend. These are no simple requirements that may need to be put into place. In fact, in a report by the research and consulting company, Ovum, found that approximately two-thirds of U.S. companies must completely rethink their cybersecurity strategy to comply with these new General Data Protection Regulations (GDPR).

GDPR is a proposal by the European Union Commission intended to help EU citizens living in the EU more control over their private data that lives in the cyber world. It affects anyone living within the EU as well as any company that exports said data outside the EU.

Fortunately, it seems that U.S. companies are taking these regulations seriously. In an IDC report, the vast majority of them reported that they are putting GDPR compliance at the top of the cybersecurity priority strategy list. Unfortunately, only one in five EU companies are prepared for it.

Even further contributing to the unfortunate news, is that employees don’t seem to be concerned about cybersecurity. Half surveyed reported that they think it’s completely fine to open any email on their work computers.  While there may be lower risk of merely opening an email, phishers are getting better at getting malware to execute just by opening a message; an attachment or link doesn’t even need to be clicked anymore. These employees also believe cybersecurity training is unimportant. Sixty-two percent (62%) said they only completed it because it was mandatory. Twenty-seven percent (27%) reported not receiving any training at all.

Individuals, whether in the U.S. or the EU will always be the weakest link when it comes to data breaches. While the perimeter security tools are a great (and mandatory) front line of defense, malicious messages still seem to make it past them. Unless employees are trained on the risk of opening these, your organization will be more likely to have to justify your efforts to a GDPR compliance officer.

Essentially, the guidelines state that if a breach does occur, the organization must notify the local authorities that in charge of these and may also be required to notify the breach victims. In addition, there may be a fine up to €20 million.

Fortunately, there are some exceptions to these guidelines. A company may be able to avoid notification requirements, for example, if it can prove that the accessed data was encrypted to a level that leaves it unintelligible to anyone who may have stolen it.

While these caveats are likely welcomed by those who must comply with GDPR, the requirements themselves are somewhat unclear. Like any compliance program, there will be a "break-in period" for everyone to figure out what these rules mean. For now, if you must be GDPR compliant, take some time to review the regulations in detail so you don’t make the headlines as one of the first companies to be fined under these for a data breach.