GDPR: Perceptions and Readiness A Global Survey of Data Privacy Professionals at companies with European Customers

Size: px

Start display at page:

Download "GDPR: Perceptions and Readiness A Global Survey of Data Privacy Professionals at companies with European Customers"

Jonathan Shelton
5 years ago
Views:

1 Sponsored by: GDPR: Perceptions and Readiness A Global Survey of Data Privacy Professionals at companies with European Customers September Sponsored by:

Goals and Methodology Research Goal Methodology Participants The primary research goal was to understand perceptions of the

An online survey was fielded to independent sources of IT and business professionals responsible for data privacy.

The survey was field in English, German, and Dutch. A total of 821 qualified individuals completed the survey.

2 Goals and Methodology Research Goal Methodology Participants The primary research goal was to understand perceptions of the General Data Protection Regulation (GDPR) among individuals responsible for data privacy at companies with European customers. An online survey was fielded to independent sources of IT and business professionals responsible for data privacy. Questions were asked about awareness of GDPR and expected impacts. Dell was not revealed as the survey sponsor. The survey was field in English, German, and Dutch. A total of 821 qualified individuals completed the survey. All had responsibility for data privacy as a significant part of their job responsibilities. All worked at companies with more than 10% of customer base in Europe. 2 Sponsored by:

Introduction to GDPR To ensure that feedback was based on existing knowledge of GDPR, this simple introduction was provided to participants before continuing into the survey questions.

3 Introduction to GDPR To ensure that feedback was based on existing knowledge of GDPR, this simple introduction was provided to participants before continuing into the survey questions. No other information about GDPR was provided to participants. Description Provided The General Data Protection Regulation (GDPR) was recently adopted by the European Union to strengthen and unify data protection for individuals within the European Union. 3 Sponsored by:

4 PARTICIPANT DEMOGRAPHICS 4 Sponsored by:

5 Participants Represented Company Size More than 5,000 employees 21% Less than 100 employees 18% = SMB = Enterprise 1,000-5,000 employees 29% 100-1,000 employees 32% All of our customers are in Europe 15% Most of our customers are in Europe 16% More than half of our customers are in Europe 16% European Footprint More than 10% of our customers are in Europe 53% Business executive (<100 employees) 6% Frontline IT professional 28% Role CIO, VP or other IT executive 28% IT team manager 38% 5 Sponsored by:

Europe 72% United Kingdom or Ireland 14% Germany 15% Sweden

6 Regions Represented United States or Canada 19% Asia Pacific (Australia, New Zealand, Singapore, Hong Kong, India) 9% Europe 72% United Kingdom or Ireland 14% Germany 15% Sweden 15% Benelux 14% France, Italy, Spain, Poland 14% 6 Sponsored by:

7 BROAD LACK OF AWARENESS ABOUT GDPR 7 Sponsored by:

Very few aware of the details of GDPR, even at companies based in Europe How would you characterize your awareness of GDPR?

I am fairly familiar with the regulations but have a lot more to learn 14% I am very knowledgeable about GDPR 4% Never heard of it

was aware there are new regulations and know some details I was aware there are new regulations and know some details 33% I knew

8 Very few aware of the details of GDPR, even at companies based in Europe How would you characterize your awareness of GDPR? Choose the answer that most closely applies. I am fairly familiar with the regulations but have a lot more to learn 14% I am very knowledgeable about GDPR 4% Never heard of it before 18% In Europe 16% 32% 30% 17% 6% Never heard of it before I knew there was something going on, but don't know any details I was aware there are new regulations and know some details I was aware there are new regulations and know some details 33% I knew there was something going on, but don't know any details 31% Outside Europe 21% 31% 38% 9% 1% I am fairly familiar with the regulations but have a lot more to learn I am very knowledgeable about GDPR 0% 20% 40% 60% 80% 100% 8 Sponsored by:

IT executives most likely to know the details of GDPR How would you characterize your awareness of GDPR? Choose the answer that most closely applies.

something going on, but don't know any details IT Administrator Business Executive 22% 20% 39% 54% 32% 17% 6% 1% 10% 0% I was aware there are new

9 IT executives most likely to know the details of GDPR How would you characterize your awareness of GDPR? Choose the answer that most closely applies. By Job Level n = European participants only IT Executive 13% 25% 28% 24% 11% Never heard of it before IT Team Mgr 12% 26% 32% 23% 8% I knew there was something going on, but don't know any details IT Administrator Business Executive 22% 20% 39% 54% 32% 17% 6% 1% 10% 0% I was aware there are new regulations and know some details I am fairly familiar with the regulations but have a lot more to learn I am very knowledgeable about GDPR 0% 20% 40% 60% 80% 100% 9 Sponsored by:

10 COMPANIES ARE NOT PREPARED FOR GDPR 10 Sponsored by:

Less than 1 in 3 companies are prepared In your

I don't know 32% Yes 31% In Europe 37% 36% 27%

11 Less than 1 in 3 companies are prepared In your opinion, is your company prepared for GDPR today? Choose the answer that most closely applies. I don't know 32% Yes 31% In Europe 37% 36% 27% Yes No I don't know Outside Europe 22% 38% 40% No 37% 0% 20% 40% 60% 80% 100% 11 Sponsored by:

Germans feel most prepared for GDPR; Benelux least In your opinion, is your company prepared for GDPR today? Choose the answer that most closely applies.

12 Germans feel most prepared for GDPR; Benelux least In your opinion, is your company prepared for GDPR today? Choose the answer that most closely applies. n = European participants only By Country Germany 44% 34% 22% UK 41% 31% 28% Sweden 33% 39% 28% Yes No Benelux 26% 43% 31% I don't know Other European Country 40% 35% 26% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 12 Sponsored by:

Consumer-focused and large companies mostly likely

By Customer Type By Company Size n = European

21% B2C 38% 35% 26% Yes No I don't know Yes No I

13 Consumer-focused and large companies mostly likely to feel prepared In your opinion, is your company prepared for GDPR today? Choose the answer that most closely applies. By Customer Type By Company Size n = European participants only B2B 24% 46% 30% Enterprise 41% 38% 21% B2C 38% 35% 26% Yes No I don't know Yes No I don't know B2C and B2B 47% 29% 24% SMB 32% 35% 32% 0% 20% 40% 60% 80% 100% 0% 50% 100% 13 Sponsored by:

14 97% don t have a plan to be ready Does your company have a plan to prepare for GDPR? Choose the answer that most closely applies. n = not ready for GDPR today We have a clear plan in place 3% 37% 27% 33% We are still working on our plan We are figuring out who needs to be involved to put a plan together We have not started on our planning 0% 20% 40% 60% 80% 100% 14 Sponsored by:

15 Less than half of Europeans think that they would have been in compliance this year If GDPR had been fully in effect in the past year, would your organization have been in compliance with the regulations? In Europe 5% 44% 43% 7% Definitely in compliance Probably in compliance Probably not in compliance Definitely not in compliance Outside Europe 15% 49% 28% 9% 0% 20% 40% 60% 80% 100% 15 Sponsored by:

Not concerned 18% Very concerned 23% In Europe 30% 52% 18% Very concerned Somewhat concerned

16 82% are concerned about GDPR compliance, concern greatest in Europe How much of a concern is GDPR compliance for your organization? Choose the answer that most closely applies. Not concerned 18% Very concerned 23% In Europe 30% 52% 18% Very concerned Somewhat concerned Not concerned Somewhat concerned 59% Outside Europe 10% 72% 18% 0% 20% 40% 60% 80% 100% 16 Sponsored by:

n = European participants only By Company Size By Country Germany 46% 40% 14% Enterprise 34% 53% 13% Sweden 33% 53% 14% Very concerned

17 Larger companies and Germans more likely to be concerned about GDRP compliance How much of a concern is GDPR compliance for your organization? Choose the answer that most closely applies. n = European participants only By Company Size By Country Germany 46% 40% 14% Enterprise 34% 53% 13% Sweden 33% 53% 14% Very concerned Somewhat concerned Benelux 32% 43% 25% Very concerned Somewhat concerned SMB 26% 52% 23% Not concerned UK 10% 63% 27% Not concerned Other European Country 24% 66% 9% 0% 20% 40% 60% 80% 100% 0% 20% 40% 60% 80% 100% 17 Sponsored by:

All 9% 41% 30% 8% 11% We will definitely be fully ready I expect we will be fully ready In Europe 12% 43% 28% 9% 8% I am

18 Most lack confidence they will be fully ready when GDPR kicks off How confident are you that your company will be fully ready for GDPR when the regulation kicks off? Choose the answer that most closely applies. All 9% 41% 30% 8% 11% We will definitely be fully ready I expect we will be fully ready In Europe 12% 43% 28% 9% 8% I am concerned we will not be fully ready I know we will not be fully ready in time I don't know Outside Europe 4% 39% 35% 7% 16% 0% 20% 40% 60% 80% 100% 18 Sponsored by:

19 FULL IMPACT OF GDPR NOT CLEAR 19 Sponsored by:

GDPR expected to impact both data security and business

20 GDPR expected to impact both data security and business outcomes In your opinion, will GDPR have an impact on your approach to DATA SECURITY? In your opinion, will GDPR have an impact on your BUSINESS OUTCOMES? No impact 17% Yes, a significant impact 28% No impact 34% Yes, a significant impact 17% Yes, a minor impact 55% Yes, a minor impact 49% 20 Sponsored by:

Majority do expect changes to security will be needed, but most think it will be minor How much do you think your current data security practices and technologies will have to change as a result

21 Majority do expect changes to security will be needed, but most think it will be minor How much do you think your current data security practices and technologies will have to change as a result of GDPR? No change 11% Significant change 23% In Europe 27% 62% 11% Significant change Minor change No change Outside Europe 16% 73% 11% Minor change 66% 0% 20% 40% 60% 80% 100% 21 Sponsored by:

22 Majority think existing practices will meet GDPR requirements with a few tweaks How do you rate your ability to comply with GDPR given your current approach to data privacy? We are already compliant and do not need to change 8% 58% 27% 7% Our existing practices will satisfy some of GDPR, but we will need to make a few changes We are compliant in a few areas, but need to make significant changes to be compliant We are not compliant at all 0% 20% 40% 60% 80% 100% 22 Sponsored by:

Lack of knowledge about penalties for lack of compliance If GDPR had been fully effect in the past year, would your organization have faced penalties given your current

23 Lack of knowledge about penalties for lack of compliance If GDPR had been fully effect in the past year, would your organization have faced penalties given your current approach to data privacy? All 21% 35% 44% Yes In Europe 23% 42% 36% No I don't know Outside Europe 17% 26% 57% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 23 Sponsored by:

Lack of knowledge about penalties for lack of compliance (con t) What level of penalty would your organization likely have faced if GDPR had been fully in

n = would have faced a penalty 17% 47% 23% 13% Severe penalty - A significant financial penalty and/or a large amount of remediation work and investment Serious

24 Lack of knowledge about penalties for lack of compliance (con t) What level of penalty would your organization likely have faced if GDPR had been fully in effect this past year given your current approach to data privacy? n = would have faced a penalty 17% 47% 23% 13% Severe penalty - A significant financial penalty and/or a large amount of remediation work and investment Serious penalty - A moderate financial penalty and/or manageable amount of remediation work and investment Slap-on-the-hand penalty - Small financial penalty and/or easy-to-achieve remediation I don't know 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 24 Sponsored by:

25 FEW FEEL PREPARED ACROSS GDPR SECURITY DISCIPLINES 25 Sponsored by:

Access management 72% Email security 72% Privileged account management 63% Secure mobile access 50% Multifactor

26 Many security disciplines that will help with GDPR have been adopted, but not all Which of the following security disciplines has your organization adopted? Choose all that apply. Access management 72% security 72% Privileged account management 63% Secure mobile access 50% Multifactor authentication 47% Next generation firewall (NGFW) 44% Access governance (attestation/recertification) 33% None of these 2% 0% 10% 20% 30% 40% 50% 60% 70% 80% 26 Sponsored by:

Those who have adopted Access Governance much more prepared for GDPR How confident are you that your company will be fully ready for GDPR when the regulation kicks off?

27 Those who have adopted Access Governance much more prepared for GDPR How confident are you that your company will be fully ready for GDPR when the regulation kicks off? Have adopted Access Governance 17% 49% 22% 6% 6% We will definitely be fully ready I expect we will be fully ready I am concerned we will not be fully ready I know we will not be fully ready in time No Access Governance 5% 38% 34% 10% 13% I don't know 0% 20% 40% 60% 80% 100% 27 Sponsored by:

Across the security disciplines impacting GDPR, few feel well prepared Each of the following security disciplines contributes to GDPR compliance.

Email security 47% 36% 7% 10% Access management 40% 44% 6% 10% Privileged account management 36% 41% 11% 12% Well prepared Secure mobile access Multifactor

28 Across the security disciplines impacting GDPR, few feel well prepared Each of the following security disciplines contributes to GDPR compliance. How well do you feel your current practices and technologies are equipped to meet GDPR compliance? security 47% 36% 7% 10% Access management 40% 44% 6% 10% Privileged account management 36% 41% 11% 12% Well prepared Secure mobile access Multifactor authentication 34% 31% 36% 39% 19% 15% 11% 14% Somewhat prepared Not prepared I don't know Next generation firewall (NGFW) 29% 36% 19% 16% Access governance (attestation/recertification) 21% 38% 22% 20% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 28 Sponsored by:

29 OTHER 29 Sponsored by:

30 IT expected to take the lead on GDPR What team in your organization currently has primary responsibility for data protection and compliance including GDPR? All By Size IT 55% IT 51% 60% Security Business management Legal 8% 7% 23% Security Legal 13% 8% 6% 32% Enterprise SMB Business operations 5% Business operations 5% 5% Other 1% Business management 2% 14% 0% 10% 20% 30% 40% 50% 60% 0% 20% 40% 60% 80% 30 Sponsored by:

In your opinion, what is your company s most likely approach to appointing a Data Protection Officer?

31 Most expect to have an in-house DPO One of the requirements of GDPR is that each company names a Data Protection Officer (DPO) with direct responsibility for compliance with GDPR. In your opinion, what is your company s most likely approach to appointing a Data Protection Officer? I couldn't even guess 14% In Europe 71% 18% 10% Outsource 18% In-house Outsource I couldn't even guess In-house 68% Outside Europe 64% 17% 19% 0% 20% 40% 60% 80% 100% 31 Sponsored by:

32 REGION-SPECIFIC QUESTIONS 32 Sponsored by:

33 Almost a half of those in the UK not clear on the impact of Brexit on GDPR To the best of your understanding, does the United Kingdom s vote to leave the European Union mean that your organization is exempt from GDPR? n = live in UK I don't know if it had an impact 32% Yes, our company is exempt 12% No, we still have to comply 56% 33 Sponsored by:

mean that your organization is exempt from GDPR?

34 Almost a half of those outside Europe not clear if GDPR impacts them To the best of your understanding, does working in a region that is not part of the European Union mean that your organization is exempt from GDPR? n = live outside of Europe I don't know 37% Yes, our company is exempt 10% No, we still have to comply 53% 34 Sponsored by:

35 For more information About Dimensional Research Dimensional Research provides practical marketing research to help technology companies make smarter business decisions. Our researchers are experts in technology and understand how corporate IT organizations operate. Our qualitative research services deliver a clear understanding of customer and market dynamics. For more information, visit About Dell Software Dell Software helps customers unlock greater potential through the power of technology delivering scalable, affordable and simple-to-use solutions that simplify IT and mitigate risk. The Dell Software portfolio addresses five key areas of customer needs: data center and cloud management, information management, mobile workforce management, security and data protection. This software, when combined with Dell hardware and services, drives unmatched efficiency and productivity to accelerate business results. For more information, visit 35 Sponsored by:

Global: On the horizon for 2017

11 Jan 2017 / Latest / Global: On the horizon for 2017 Global: On the horizon for 2017 By Sarah Hellewell / 15 Dec 2016 Regions & Countries Kenya, Mozambique, Nigeria, South Africa, Brazil, Canada, Mexico,