GDPR compliance: Whose job is it and is it really possible?

Different approaches

Giles Watkins, UK country lead for the International Association of Privacy Professionals (IAPP), said a core problem that explains how different people envisage compliance relates to how they approach the regulations to begin with.

“There are three bubbles – privacy, identity and security,” he said. “People think these are the same thing, but they are not. There’s strong overlap, but they are very different disciplines.”

Watkins explained that privacy, to begin with, came out of the legal profession and was integrated into IT, while security began within the IT world, and identity sits somewhere between the two, as a result of the interaction of humans with IT.

“That means you get different answers if you ask an IT person, a lawyer or someone in charge of customer service whether they are GDPR compliant,” he said. “You get incredibly different answers. I think that’s part of what’s behind that, who you are asking.”

Happily, it also appears that those responding to these surveys are answering the questions honestly, at least to the best of their ability. The IAPP recently conducted its own survey on security governance, working alongside consultancy EY, in which 43% of respondents said they were only “moderately” compliant with GDPR, and Watkins said he was actually pleasantly surprised at how candid most people were about their readiness, particularly CISOs and other security professionals whose jobs are on the line if their employer is breached.

“The truth of it is that organisations have probably figured out what they need to do and they are comfortable that they have a plan,” said Watkins.

But he added that a proper plan for GDPR compliance will take years to implement because it is multifaceted – some of it is about internal change, some of it is about standardisation, some about data audit, some about retiring legacy systems – and these are not things that can happen overnight.

The upshot of this? Security professionals should not necessarily panic when they see stories about GDPR compliance.

Actually, said Watkins, it is highly unlikely that any business will ever be able to reach a point at which it can say for sure that it even is GDPR compliant. Why should this be? It relates to how data has been managed in enterprises up to now.

“The number one hardest task when complying with GDPR is locating unstructured data,” he said. “Do we know what we’ve got and where it is?”

The answer to this question is “not fully”, said Watkins, because of a multitude of factors, such as legacy systems that don’t talk to each other, multiple sites with different backups, and shadow IT installations holding data that nobody ever knew existed for sure.

In fact, this was also one of the takeaways from Capgemini’s survey data, which showed that one-third of enterprises rate legacy equipment as their biggest GDPR challenge.

Although there are tools that can search these data repositories and find exactly what enterprises do have, they are by no means perfect, and there is still a lot of manual sifting to do, said Watkins.

“That’s ongoing and it changes all the time, it has to be constantly updated, it’s not a one-off-exercise,” he said. “What that means is you need a lot of resources to do GDPR, and a lot of resource needs to stay there.

“That’s the expensive bit. A lot of people pay consultants to do a lot of those projects and say they’re compliant, but the moment they are compliant, they start to fall out of compliance and it’s maintaining that, that is the real challenge.”

Watkins added: “I’d be very surprised if any organisation is fully compliant, but do they understand what they need to do and are they confident they are on the right path? Those figures are higher.”

A positive future for GDPR

Indeed, the IAPP’s numbers seem to suggest that investment around GDPR is starting to flatten – although it remains high – as security professionals grow more confident that they have got their heads around the key points and developed a workable action plan.

It is also important to note that there is some anecdotal evidence to suggest that internally, the ICO is taking the position that it doesn’t really expect everybody’s GDPR compliance to be watertight, but if it sees evidence of a plan, and progress towards a goal, it will be less minded to impose the maximum 4% of turnover fine if a business is breached because, despite its best efforts, it was unlucky. Complacency, on the other hand, will be punished.

Kevin Duffy, co-chair of cyber and convergence at the Security Institute, the UK’s largest professional membership body for security practitioners, and managing director of reputation management firm Cyber Rescue, said he sees evidence that GDPR is stimulating cultural change within organisations, and for that reason has the potential to be enormously effective.

“When I was a kid, there was cultural change because a law came in saying my parents had to tell me to put a seatbelt on,” he said. “I feel like all of us now, every time we get in the car, whether it was the law or not, we’d put a seatbelt on.

“GDPR is helping businesses see that they’ve got shadow IT and data that’s all at risk, they could get fined 4% of turnover, their reputation could get slammed.

“If the culture changes then every time a business introduces a new platform or service, then eventually it goes, oh, shall we put our seatbelt on?”