Data Protection SME Business Study (April 2018 Version 1.1) ireach Insights Limited 2018

Transcription

1 Data Protection SME Business Study (April 2018 Version 1.1) ireach Insights Limited 2018

2 Data Protection SME Business Study EXECUTIVE SUMMARY OVER VIEW KEY POINTS 2018 saw a two-fold increase in awareness amongst SMEs in Ireland regarding the major changes in DP legislation taking place soon and a nearly three-fold rise in awareness of the GDPR start date. Five times more SME business executives are able to name 3 GDPR changes. There is a two fold increase in clarity as to whether businesses will be required to appoint a Data Protection Officer sees a considerable rise in awareness of non-compliance penalties. More than twice as many SMEs have identified steps for compliance with GDPR. More SMEs have carried out an assessment of all the personal data held, reasons why, and for how long it needs to be kept. In 2018 more than 4 in 10 SMEs have evaluated the necessity of a DP Impact Assessment with 1 in 4 SMEs developing a DP Risk register. More than 6 in 10 SMEs recognise DP as an indispensable part of their current and future business planning. More SMEs this year consider DP compliance as a priority in their organisations with almost 4 in 10 SMEs having already actioned their GDPR implementation plan. Data Protection Legislation Changes & GDPR Awareness Actions Taken in Preparation & Compliance with GDPR 2018 saw a two-fold increase in awareness amongst SME businesses in Ireland (90%) compared to last year (44%) regarding the major changes in data protection legislation taking place soon. There s also a nearly three-fold rise in awareness of the GDPR start date (87% vs 30% in 2017). This year five times more SME business executives demonstrate knowledge of the consequences GDPR will have for their organisations with 30% now being able to name 3 changes compared to only 6% in There s a two fold increase in clarity (44% vs 21% in 2017) as to whether each business will be required to appoint a Data Protection Officer within the organisation sees a considerable 24% rise in awareness of the penalties imposed on companies for failure to comply with GDPR (65% versus 41% in 2017). In 2018 more than twice as many SMEs (52% vs 21% in 2017) have identified steps for compliance with GDPR with 6% more (57% vs 51% in 2017) assigning a staff member to oversee GDPR preparation. This year 13% more SMEs (45% vs 32% in 2017) have carried out an assessment of all the personal data held in the organisation; 9% more (51% vs 42%) have analysed why to keep that data and 12% more (47% vs 35%) have assessed the necessary length of time to hold personal data. In 2018 more than 4 in 10 SMEs (43%) have initiated an evaluation to establish the necessity for carrying out a Data Protection Impact Assessment with every 4 th company (25%) developing a data protection risk register to identify and mitigate data protection associated risks. Almost 4 in 10 SMEs or 37% have already actioned their GDPR implementation plan. Importance Placed on GDPR In 2018 more than 6 in 10 SMEs in Ireland (61%) recognise data protection as an indispensable part of their current and future business activity planning. 7% more SMEs this year (69%) compared to 2017 (62%) consider data protection compliance as a priority in their organisation.

3 Data Protection SME Business Study Methodology Data Protection SME Business Study Study conducted as a Standalone CATI and CAWI Survey of SMEs in Ireland Online Survey Fieldwork undertaken from 24 th April 14 th May 2018 Consumer Research Project Conducted by ireach Insights on behalf of the Data Protection Commissioner Mi Pro Survey Software ireach utilises leading market research solution for all aspects of survey project management: sampling, design, data collection and tabulation Consumer Panel Consumer Research Study conducted nationwide Sample Size = 500 SME Decision Makers with responsibility for Compliance or Data Protection ireach Online Consumer Panel ireach uses proprietary research panels across consumer and business groups, built on a nationally representative model Confidence Level The ireach Consumer Decisions Omnibus delivers a high level statistical accuracy. Delivering a sample size of over 500 interviews, this provides a confidence level of + or 3% at a 95% confidence interval.

4 Data Protection SME Business Study DEMOGRAPHICS Owner Job Title/ Position in the Company Senior Manager Managing Director CEO Data Compliance Officer Other position with responsibility for data Other (please specify): Number of % 21% 8% 2% 2% 43% 0% 38% Agriculture, forestry and fishing Arts and entertainment Industry Sector Banking, insurance & other financial services Charity, social enterprise or non-profit Central or Local government Construction Consulting or other professional/ advisory services Education and Training Health and social care Hospitality and recreation Manufacturing Retail or wholesale ICT and Telco products/ services 3% 2% 8% 5% 0% 5% 9% 10% 11% 9% 4% 12% 5% Carlow Cavan Clare Cork Donegal Dublin Galway Kerry Kildare Kilkenny Laois Leitrim Limerick Business Location 0% Longford 1% Louth 1% Mayo 15% Meath 3% Monaghan 40% Offaly 6% Roscommon 1% Sligo 4% Tipperary 0% Waterford 1% Westmeath 0% Wexford 4% Wicklow 1% 2% 2% 3% 1% 0% 1% 2% 3% 4% 1% 2% 2% % 26% % Technical and scientific services Transport, logistics and storage Utilities Other (please specify): 2% 5% 1% 9% 17% 28% 15% Dublin 40%

5 Data Protection SME Business Study SURVEY QUESTIONS Questions QA. Which of the following best describes your job title/position in the company? (Single Select) QB. Which industry sector does your company or organisation operate in? If you operate in more than one, please answer for the main/ largest area of operations. (Single Select) QC. How many employees, both full and part-time, does your business or organisation have in the Republic of Ireland? Please consider the entire company on all sites! (Single Select) QD. Where is your business located? (Single Select) Q1. Does your organisation collect and use personal data? (e.g. Employee data such as Payroll etc, database of customer details, etc.) (Single Select) Q2. Is the data you collect and process confined to personal information about your employees or more broad-based to include information about your customers / clients? (Single Select) Q3. Are you aware that major changes to data protection law are imminent? (Single Select) Q4. Do you know that the General Data Protection Regulation will be effective from 25 th May 2018? (Single Select) Q5. If asked, could you name three changes that the General Data Protection Regulation will mean for your organisation? (Single Select) Q6. Do you know, for example, if your organisation will be required to appoint a Data Protection Officer? (Single Select) Q7. Have you identified the steps/ actions that your organisation will need to take to be compliant with the General Data Protection Regulation? (Single Select) Q8. Do you have a staff member(s) who is responsible for overseeing compliance with data protection and preparing for the GDPR? (Single Select)

6 Data Protection SME Business Study SURVEY QUESTIONS Questions Q9. Have you carried out an assessment of all the personal data you hold? (Single Select) Q10. Have you carried out an assessment of why you hold personal data? (Single Select) Q11. Have you carried out an assessment of how long you need to keep the personal data you hold? (Single Select) Q12. Is data protection included as a consideration in the planning phase of your ongoing and future business activity? (Single Select) Q13. Have you carried out an evaluation to establish whether or not the nature of your company s processing requires you to carry out a Data Protection Impact Assessment? (Single Select) Q14. Have you developed a data protection risk register to help identify and mitigate data protection risks? (Single Select) Q15. Are you using, or planning to use, an outside resource to help your organisation prepare for the General Data Protection Regulation? (Single Select) Q16. And, what type of service provider are you using or planning to use? Please select all that apply. (Multiple Select) Q17. Are you aware of some of the penalties that can be imposed on companies for failing to comply with the General Data Protection Regulation? (Single Select) Q18. To what extent do you think data protection compliance is a priority in your organisation at owner/boardroom/senior management level? (Single Select) Q19. Have you actioned your GDPR implementation plan? (Single Select) Q20. What format of guidance would you find most helpful to your preparations for the General Data Protection Regulation? Please select all that apply. (Multiple Select)

7 In 2018 an almost equal number of SMEs (84% or 5%) compared to 2017 (89%) state they collect and use personal data highest for large companies with employees and businesses located in Connacht/Ulster (both at 92%). Personal Data: Collection and Usage 84% 89% 18% less small businesses employing 1-9 staff (74%) compared to larger ones with employees (92%) collect and use personal data as part of their business operations. The collection and usage of personal data follows a progressive trend depending on company size 74% for small, 90% for medium-size and 92% for large companies YES 16% 11% NO / DK Q: Does your organisation collect and use personal data? (e.g. Employee data such as Payroll etc, database of customer details, etc.) (Single Select, n = 500)

8 In % of SMEs collect & process both employees and customers /clients data. This compares to last year with 69% selecting broad-based customer/client data as there was not both employees and customers option. Types of Collected Personal Data In 2018 large companies ( employees) stand out as the ones mostly collecting only broad-based information (25% or 4% above average). 13% more middle-sized companies (32%) compared to large ones (19%) seem to be collecting Employee details only in their databases. Broad-based including information about customers/ clients Both employees and customers/ clients data Employee details only Don t know % 46% 27% 6% 69% ---% 28% 3% Q: Is the data you collect and process confined to personal information about your employees or more broad-based to include information about your customers / clients? (Single Select, n = 500)

9 2018 witnesses more than a two-fold increase in awareness amongst SME businesses in Ireland (90%) regarding the major changes in data protection legislation taking place soon compared to last year (44%) highest for Connacht/ Ulster at 95%. Data Protection Changes Awareness 90% 2018 YES Larger companies are slightly more aware of the imminent changes (92%) compared to smaller and medium sized businesses (both at 90%) Regionally, companies in Connacht/Ulster stand out as the most aware of the changes to data protection law (95%) % NO 2017 Q: Are you aware that major changes to data protection law are imminent? (Single Select, n = 500) 44% 56%

10 In 2018 there is a nearly three-fold rise in awareness amongst Irish SMEs of the GDPR start date (87%) compared to last year (30%) highest for Connacht/ Ulster at 95%. GDPR Start Date Awareness 87% 30% 13% 70% Larger companies again seem to be slightly more aware of the date GDPR becomes effective (88%) compared to smaller and medium sized businesses (both at 86%). Regionally, companies in Connacht/Ulster stand out as the most aware of the start date (95% or 9% - 11% higher than NO the other three regions in Ireland) YES MAY 25 NO Q: Do you know that the General Data Protection Regulation will be effective from 25 th May 2018? (Single Select, n = 500)

11 In 2018, five times more SME business executives demonstrate knowledge of the consequences GDPR will have for their organisations with 30% now being able to name 3 changes compared to only 6% in Also, three times more respondents (30%) state they can name at least 1 or 2 such changes compared to 11% last year. Ability to Name GDPR Changes Large companies employees show better ability to name 3 changes (36%) than staff in small and medium entities ( 8% to 10%, respectively). In a regional perspective, RoL and Munster fall behind Connacht/Ulster and Dublin when it comes to naming three GDPR changes. 30% 6% 30% 11% 40% 83% YES, I could name three NO, but I could name one or two NO NO, I could not name any Q: If asked, could you name three changes that the General Data Protection Regulation will mean for your organisation? (Single Select, n = 500)

12 This year we witness a two fold increase in clarity (44%) compared to last year (21%) as to whether each SME business will be required to appoint a Data Protection Officer within the organisation highest for Connacht/ Ulster at 53%. Appointing a Data Protection Officer 56% 79% 44% 21% Large companies employees are more aware of this requirement (50%) than small and mediumsized ones 44% and 40%, respectively. Regionally, Munster is at the bottom of the list with only 34% being aware of the need to appoint a Data Protection Officer i.e. 19% less compared to Connacht/ Ulster at 53% YES NO / DK Q: Do you know, for example, if your organisation will be required to appoint a Data Protection Officer? (Single Select, n = 500)

13 In 2018 more than twice as many SMEs (52%) compared to 2017 (21%) confirm to having identified steps for compliance with the General Data Protection Regulation highest for Rest of Leinster at 59%. Steps for Compliance with GDPR NO/ DK 48% 79% NO/ DK Steps/ Actions identification increases with company size: 48% for small, 53% for medium and 55% for large companies. YES % 21% YES 2017 Regionally, at 43% Munster is more than 10% behind all other regions when it comes to pin-pointing steps or actions for GDPR compliance. Q: Have you identified the steps/ actions that your organisation will need to take to be compliant with the General Data Protection Regulation? (Single Select, n = 500)

14 In % more SME businesses (57%) compared to last year (51%) have assigned a staff member to oversee compliance with and preparation for the GDPR highest for large companies at 69% or 12% above average. Staff Responsible for GDPR Compliance 57% 51% 43% 49% Considerably more larger companies (69%) compared to medium-sized (57%) and especially small ones (49%) have a staff member responsible for overseeing GDPR preparation and compliance. Regionally, at 47% fewer companies in Munster seem to have such a staff member appointed which is more than 12% less than the other three regions YES NO / DK Q: Do you have a staff member(s) who is responsible for overseeing compliance with data protection and preparing for the GDPR? (Single Select, n = 500)

15 Coming closer to the GDPR start date, in % more SMEs (45%) than in 2017 (32%) have carried out an assessment of all the personal data held in the organisation highest for larger SMEs at 48%. Assessments on Personal Data Held 55% % 68% % YES NO/ DK Medium-sized businesses (41%) fall behind smaller companies (46%) and especially larger ones (48%) when it comes to initiating all-encompassing personal data assessments. Regionally, at 42% Connacht/ Ulster is at the bottom of the list of all regions for that undertaking. Q: Have you carried out an assessment of all the personal data you hold? (Single Select, n = 500)

16 In 2018, carrying out analyses of the reasons why SME businesses need to hold personal data also follows an upward trend (51%) or 9% compared to 2017 (42%) highest for Connacht/ Ulster at 58%. Assessment of Reasons for Holding Personal Data % 49% 51% 58% YES NO/ DK 6% more small and large companies (both at 53%) than medium-sized ones (47%) have carried out an assessment of why their organisations need to hold personal data. Regionally, Munster is at the bottom of the region list at 46% or 12% less compared to Connacht/ Ulster. Q: Have you carried out an assessment of why you hold personal data? (Single Select, n = 500)

17 In 2018, 12% more SMEs (47%) in comparison to 2017 (35%) have carried out an assessment of the length of time personal data needs to be kept in the organisation highest for Connacht/ Ulster at 52%. Necessary Length of Period Assessment 53% % 65% % YES NO/ DK More large companies (51%) than small (45%) and medium-sized entities (46%) have carried out an assessment of how long their organisations need to keep personal data. Regionally again, at 41% Munster is at the bottom of the list or 11% less compared to Connacht/ Ulster. Q: Have you carried out an assessment of how long you need to keep the personal data you hold? (Single Select, n = 500)

18 This year more than 6 in 10 SMEs in Ireland (61%) recognise data protection as an indispensable part of their current and future business activity planning highest for medium-sized SME companies and those located in Dublin (both at 65%). Data Protection Future Consideration Small companies (55%) incorporate data protection as a consideration in their future business planning the least, compared to medium (65%) and large entities (63%). In a regional aspect, at 65% Dublin businesses top the list of all regions which is 9% more compared to Connacht/Ulster at the bottom (56%) % YES 61% NO/ DK Q: Is data protection included as a consideration in the planning phase of your ongoing and future business activity? (Single Select, n = 500)

19 In 2018 more than 4 in 10 SMEs (43%) have initiated an evaluation to establish the necessity for carrying out a Data Protection Impact Assessment highest for large SMEs at 49%. Data Protection Impact Assessment 13% more large companies (49%) compared to small (36%) and 5% more compared to medium-sized ones (44%) have carried out such an evaluation. Regionally, at 45% Munster leads the way compared to the rest of the regions in Ireland % 43% YES NO/ DK Q: Have you carried out an evaluation to establish whether or not the nature of your company s processing requires you to carry out a Data Protection Impact Assessment? (Single Select, n = 500)

20 In % of SMEs have developed a data protection risk register to identify and mitigate risks associated with data protection highest for large SMEs at 36% or 11% above the general trend. Data Protection Risk Register Twice as many large companies (36%) as small ones (18%) have developed a data protection risk register % 25% YES NO/ DK The bigger the company, the greater the chance of having such a risk register: 18% for small; 25% for medium-sized and 36% for large business establishments. Q: Have you developed a data protection risk register to help identify and mitigate data protection risks? (Single Select, n = 500)

21 In 2018 and 2017, exactly the same number of companies (21%) are using or planning to use an outside source for help in their preparation for the GDPR highest for large SMEs at 27%. Plans for Using an Outside Source 79% 79% 21% 21% Nearly twice as many large companies (27%) as small ones (15%) use or have plans to refer to an outside source for help. The larger the company, the greater the chance of using an external help to assist with GDPR preparation: 15% for small; 23% for mediumsized and 27% for large business establishments. In a regional perspective, at 25% Dublin companies lead the way whereas those located in Connacht/Ulster are at the end (15%) YES NO / DK Q: Are you using, or planning to use, an outside resource to help your organisation prepare for the General Data Protection Regulation? (Single Select, n = 500)

22 In 2018, most of the companies already using or planning to use an outside source for assistance, give preference to consultancy firms (65%), followed by law firms (19%) this trend has slightly shifted compared to last year as law firms now stand out as the 2 nd most preferred external source. Types of Outside Service Providers NO/DK 79% YES 21% At 79% businesses in Rest of Leinster most of all other cohorts give preference to consultancy firms, whereas law firms seem to be predominantly considered by large entities (27%). NO/ DK 79% YES 21% Don t know 11% 19% Law Firm Don t know 7% 26% Law Firm Other outside source (please specify) 14% 65% Consultancy Firm Other outside source (please specify) 35% 52% Consultancy Firm Other e.g. IT firm, Skillsnet course; IBEC; Charity regulator; Department of Education Guidelines; Retail group; Parent Company, etc. Other e.g. Q: And, what type of service provider are you using or planning to use? Please select all that apply. (Multiple Select, n = 105)

23 In 2018 there is a considerable ( 24%) increase in awareness of the penalties imposed on companies for failure to comply with GDPR (65% versus 41% in 2017) this figure is highest for SMEs in Dublin at 70%. GDPR Non-Compliance Penalties Awareness % YES Medium-sized SMEs seem to be most aware of the GDPR non-compliance penalties (69%) compared to small (60%) and even larger ones (67%). Regionally, Dublin companies stand out as the most aware (70%) whereas those based in Munster as the least (56%) % 35% NO 2017 Q: Are you aware of some of the penalties that can be imposed on companies for failing to comply with the General Data Protection Regulation? (Single Select, n = 500) Q: Are you aware of the large scale administrative fines that can be imposed for failing to comply with the General Data Protection Regulation? (2017) 59%

24 7% more SMEs this year (69%) compared to last (62%) consider data protection compliance as a priority in their organisation - highest for large SMEs at 79% or 10% above average. Data Protection Compliance as a Priority 30% 69% 62% High Priority 37% 2% 39% 17% 12% Priority Neither/ Nor Low Priority Not a Priority at all 25% 16% 12% 11% Prioritising data protection compliance grows up with company size: small 61%; medium 68%; large 79%. In a regional aspect, at 72% Connacht/ Ulster tops the list for placing a priority on data protection compliance, whereas Rest of Leinster finds itself at the bottom 63%. Q: To what extent do you think data protection compliance is a priority in your organisation at owner/boardroom/senior management level? (Single Select, n = 500)

25 Almost 4 in 10 SMEs or 37% have already actioned their GDPR implementation plan highest for large SMEs at 47% or 10% above average. Taking Actions on GDPR Implementation Plan 2018 Probabilities for actioning the GDPR implementation plan increase with company size: small 29%; medium - 37%; large 47%. 63% 37% YES NO/ DK Regionally, companies in Dublin and Connacht/ Ulster (both at 38%) have mostly taken actions for applying the GDPR implementation plan within their organisations. Q: Have you actioned your GDPR implementation plan? (Single Select, n = 500)

26 In preparation for GDPR in 2018, SMEs seem to have selected fewer types of information guidance formats compared to This year most organisations define downloadable PDF as most helpful (53%) whereas last year web-based guidance was mostly preferred. Most Helpful Format of Guidance % Web-based guidance 86% 85% 53% Downloadable PDF guidance 29% 26% Hardcopy guidance 57% 54% Video clips/ animations 46% Other e.g. IPU handbook; Personal presentations; Seminars/training from state or semi-state bodies such as Enterprise Ireland; F2F workshops; Helpline, etc. 15% 3% 19% 12% 2% Infographics Other (please specify) Don't know Web-based guidance preference is highest for Munster at 54%; Downloadable PDF for Rest of Leinster at 64%; Hard copy for Munster and large companies (both at 33%); Video clips for large entities at 32% and infographics again for large establishments at 21%. Q: What format of guidance would you find most helpful to your preparations for the General Data Protection Regulation? Please select all that apply. (Multiple Select, n = 500)

27 Oisin Byrne Research Director Irena Butt Lead Research Analyst THANK YOU. ireach Insights Limited Phone: ireach.insights ireachinsights

28 APPENDIX

29 Personal Data: Collection and Usage Total Dublin Rest of Leinster Munster Connaught / Ulster YES 84% 74% 90% 92% 85% 79% 82% 92% NO/ Don t Know 16% 26% 10% 8% 15% 21% 18% 8% Q: Does your organisation collect and use personal data? (e.g. Employee data such as Payroll etc, database of customer details, etc.) (Single Select, n = 500)

30 Types of Collected Personal Data Total Dublin Rest of Leinster Munster Connaught / Ulster Employee details only 27 % 26 % 32 % 19 % 22 % 28 % 35 % 22 % Broad-based including information about customers/ clients Both employees and customers/ clients data 21 % 22 % 18% 25 % 24 % 22 % 21 % 16 % 46 % 46 % 46 % 46 % 48 % 48 % 37 % 55 % Don t know 6 % 6 % 4 % 10 % 6 % 2 % 7 % 7 % Q: Is the data you collect and process confined to personal information about your employees or more broad-based to include information about your customers / clients? (Single Select, n = 500)

31 Data Protection Changes Awareness Total Dublin Rest of Leinster Munster Connaught / Ulster YES 90 % 90 % 90 % 92 % 89 % 93 % 89 % 95 % NO 10 % 10 % 10 % 8 % 11 % 7 % 11 % 5 % Q: Are you aware that major changes to data protection law are imminent? (Single Select, n = 500)

32 GDPR Start Date Awareness Total Dublin Rest of Leinster Munster Connaught / Ulster YES 87 % 86 % 86 % 88 % 85 % 84 % 86 % 95 % NO 13 % 14 % 14 % 12 % 15 % 16 % 14 % 5 % Q: Do you know that the General Data Protection Regulation will be effective from 25 th May 2018? (Single Select, n = 500)

33 Ability to Name GDPR Changes Total Dublin Rest of Leinster Munster Connaught / Ulster Yes, I could name three No, but I could name one or two No, I could not name any 30% 28 % 26 % 36 % 35 % 28 % 19 % 37 % 30% 29 % 37 % 22 % 30 % 32 % 33 % 24 % 40% 43 % 37 % 42 % 35 % 40 % 48 % 39 % Q: If asked, could you name three changes that the General Data Protection Regulation will mean for your organisation? (Single Select, n = 500)

34 Appointing a Data Protection Officer Total Dublin Rest of Leinster Munster Connaught / Ulster YES 44% 44% 40% 50% 48% 42% 34% 53% NO/ DK 56% 56% 60% 50% 52% 58% 66% 47% Q: Do you know, for example, if your organisation will be required to appoint a Data Protection Officer? (Single Select, n = 500)

35 Steps for Compliance with GDPR Total Dublin Rest of Leinster Munster Connaught / Ulster YES 52% 48% 53% 55% 53% 59% 43% 56% NO/ DK 48% 52% 47% 45% 47% 41% 57% 44% Q: Have you identified the steps/ actions that your organisation will need to take to be compliant with the General Data Protection Regulation? (Single Select, n = 500)

36 Staff Responsible for GDPR Compliance Total Dublin Rest of Leinster Munster Connaught / Ulster YES 57% 49% 57% 69% 59% 60% 47% 66% NO/ DK 43% 51% 43% 31% 41% 40% 53% 34% Q: Do you have a staff member(s) who is responsible for overseeing compliance with data protection and preparing for the GDPR? (Single Select, n = 500)

37 Assessment of Personal Data Held Total Dublin Rest of Leinster Munster Connaught / Ulster YES 45% 46% 41% 48% 46% 45% 44% 42% NO 55% 54% 59% 52% 54% 55% 56% 58% Q: Have you carried out an assessment of all the personal data you hold? (Single Select, n = 500)

38 Assessment of Reasons for Holding Personal Data Total Dublin Rest of Leinster Munster Connaught / Ulster YES 51% 53% 47% 53% 50% 54% 46% 58% NO/ DK 49% 47% 53% 47% 50% 46% 54% 42% Q: Have you carried out an assessment of why you hold personal data? (Single Select, n = 500)

39 Necessary Length of Period Assessment Total Dublin Rest of Leinster Munster Connaught / Ulster YES 47% 45% 46% 51% 49% 46% 41% 52% NO/ DK 53% 55% 54% 49% 51% 54% 59% 48% Q: Have you carried out an assessment of how long you need to keep the personal data you hold? (Single Select, n = 500)

40 Data Protection Future Consideration Total Dublin Rest of Leinster Munster Connaught / Ulster YES 61% 55% 65% 63% 65% 63% 57% 56% NO/ DK 39% 45% 35% 37% 35% 37% 43% 44% Q: Is data protection included as a consideration in the planning phase of your ongoing and future business activity? (Single Select, n = 500)

41 Data Protection Impact Assessment Total Dublin Rest of Leinster Munster Connaught / Ulster YES 43% 36% 44% 49% 42% 41% 45% 42% NO/ DK 57% 64% 56% 51% 58% 59% 55% 58% Q: Have you carried out an evaluation to establish whether or not the nature of your company s processing requires you to carry out a Data Protection Impact Assessment? (Single Select, n = 500)

42 Data Protection Risk Register Total Dublin Rest of Leinster Munster Connaught / Ulster YES 25% 18% 25% 36% 25% 26% 24% 26% NO/ DK 75% 82% 75% 64% 75% 74% 76% 74% Q: Have you developed a data protection risk register to help identify and mitigate data protection risks? (Single Select, n = 500)

43 Plans for Using an Outside Source Total Dublin Rest of Leinster Munster Connaught / Ulster YES 21% 15% 23% 27% 25% 22% 19% 15% NO/ DK 79% 85% 77% 73% 75% 78% 81% 85% Q: Are you using, or planning to use, an outside resource to help your organisation prepare for the General Data Protection Regulation? (Single Select, n = 500)

44 Types of Outside Service Providers Total Dublin Rest of Leinster Munster Connaught / Ulster Law Firm 19 % 21 % 11 % 27 % 26 % 9 % 9 % 25 % Consulting firm 65 % 71 % 63 % 61 % 60 % 79 % 71 % 50 % Other outside source (please specify) 14 % 14 % 11 % 17 % 12 % 12 % 11 % 30 % Don t know 11 % 0 % 21 % 9 % 11 % 0 % 16 % 18 % Q: And, what type of service provider are you using or planning to use? Please select all that apply. (Multiple Select, n = 105)

45 GDPR Non-Compliance Penalties Awareness Total Dublin Rest of Leinster Munster Connaught / Ulster YES 65 % 60 % 69 % 67 % 70 % 69 % 56 % 67 % NO 35 % 40 % 31 % 33 % 30 % 31 % 44 % 33 % Q: Are you aware of some of the penalties that can be imposed on companies for failing to comply with the General Data Protection Regulation? (Single Select, n = 500)

46 Data Protection Compliance as a Priority Total Dublin Rest of Leinster Munster Connaught / Ulster High Priority 30% 27 % 25 % 40 % 33 % 22 % 26 % 35 % Priority 39% 34 % 43 % 39 % 35 % 41 % 43 % 37 % Neither/ nor 17% 22 % 15 % 14 % 14 % 24 % 20 % 14 % Low priority 12% 14 % 13 % 7 % 15 % 7 % 9 % 14 % Not a priority at all 2% 3 % 4 % 0 % 3 % 6 % 2 % 0 % Q: To what extent do you think data protection compliance is a priority in your organisation at owner/boardroom/senior management level? (Single Select, n = 500)

47 Taking Actions on GDPR Implementation Plan Total Dublin Rest of Leinster Munster Connaught / Ulster YES 37% 29% 37% 47% 38% 36% 34% 38% NO/ DK 63% 71% 63% 53% 62% 64% 66% 62% Q: Have you actioned your GDPR implementation plan? (Single Select, n = 500)

48 Most Helpful Format of Guidance Total Dublin Rest of Leinster Munster Connaught / Ulster Web-based guidance 48 % 44 % 52 % 48 % 43 % 52 % 54 % 45 % Downloadable PDF guidance 53 % 53 % 54 % 50 % 50 % 64 % 51 % 53 % Hardcopy guidance 29 % 24 % 32 % 33 % 24 % 32 % 33 % 31 % Video clips/ animations 26 % 22 % 25 % 32 % 30 % 24 % 22 % 21 % Infographics 15 % 11 % 14 % 21 % 20 % 19 % 7 % 13 % Other (please specify) 3 % 0 % 7 % 2 % 4 % 3 % 2 % 4 % Don t know 12 % 11 % 12 % 14 % 15 % 7 % 14 % 9 % Q: What format of guidance would you find most helpful to your preparations for the General Data Protection Regulation? Please select all that apply. (Multiple Select, n = 500)