New Data Regulations Affecting Security Budgets

At a time when governments and companies worldwide are needing to revisit their data security policies, so goes their need to focus on reassessing security budgets. After data abuse scandals like Facebook and Cambridge Analytica surfaced, those in charge of securing personal data sat up and took notice. Some governments have created laws about information privacy in hopes of protecting consumers from data mismanagement and theft. This may be the latest trend in data security, and chief information security managers (CISOs) are learning it may be time to pay-up and bolster security or face hefty financial fines.

Recent data protection laws in California and the European Union (EU) require organizations of all types to protect and reshape the personal information they collect on their consumers. Both have deadlines for businesses to comply or face penalties. California recently created the California Consumer Privacy Act of 2018 (CCPA). To date, it’s one of the toughest data privacy laws in the U.S. Like the EU’s General Data Protection Regulation (GDPR) that went into effect this past summer, this Act gives its consumers control over what and how data is collected by businesses in their state. Non-compliance with the GDPR, can mean fines up to 4% of an organizations global annual profit from the prior year. In California, it could mean up to $7,500 per consumer for a data breach. It can also mean a fee of $7,500 per violation. That may not sound like much but consider the number of consumers affected and number of violations, the cost to a CA business could be enormous.

Consumers agree it’s a great step toward protecting their data, but business owners here and abroad are scrambling to provide that assurance. Proper data protection is expensive to begin with and the new protection laws are tossing a financial monkey wrench into the mix. The Ponemon Institute and Globalscape report The True Cost of Compliance with Data Protection Regulations takes a look at the cost of compliance versus the cost of not complying. The report finds that non-compliance is actually 2.71 times more than the cost to comply. The report goes on to say that companies with less than 5,000 employees will be hardest hit by compliance costs. It also finds that the average cost of multinational businesses complying in the U.S. cost $5.47 million in 2017. The average cost of not complying during this same year was $14.28 million. Companies throughout the world could be facing their most important decision yet. If they choose compliance, how much of an increase in their IT budget is necessary? If their choice is not to comply, they need to consider the exorbitant fines they could face. There seems to be only one thing for sure, either decision is going to be costly.