With GDPR about to strike, who is actually ready? The Industry speaks…

No doubt many of our in-boxes are already filling up with messages from companies pleading with us to opt-in and remain on their books – a looming sign of the inevitability of the Government Data Protection Regulations (GDPR) kick-off on May 25^th, 2018. But even with just a few short days before the deadline, our research tells us that many companies are ill-prepared, or worse still, aren’t even sure how the regulation will impact their business. There are considerable variances by geography, and as one would expect, the differences between the UK and the rest of Europe provide the opportunity for inference and speculation.

HfS Research has been conducting a State of Security Survey, with large enterprise organizations across the globe, surveying 300 business leaders in companies with over $1 Billion in revenue, during April 2018 and Early May. To discover current levels of compliance with GDPR, we asked some additional questions about understanding and current status.

European businesses forge ahead with awareness about the impact of GDPR

Before we do any speculation and prediction, let’s dig into the data and find out what’s really going on as far as enterprise leaders are concerned. In Exhibit 1, we can see the overall level of awareness about the impact of GDPR on businesses, split by geographic region. Perhaps unsurprisingly, Europe (excluding UK) is forging ahead with the highest level of awareness, with 92% of respondents advising they know how the new regulations will impact their business. But contrast this with the UK, where only 78% advised they knew what to expect, and we can start to see a bleak picture. In fact, the UK is by far the least aware, with all other geographic areas reporting higher numbers of business leaders in the loop.

Exhibit 1: Understanding of impact of GDPR by region

Source: HfS Research, 2018; N-300 Business Executives

It would be unfair to chide UK business leaders too much when comparing them to other major geographies – for many North American or Asian businesses with limited business conducted with European citizens, the impact may be clearer cut. Similarly, with European businesses that conduct most of their business within the EU, it may be easier to understand the dependencies and risks involved. It’s also a little unclear whether the ongoing confusion around Brexit is holding some UK businesses back from being able to clearly map out the effect of the regulation.

But… UK businesses are the best prepared 

However, understanding the impact doesn’t seem to be holding a lot of UK businesses back. In Exhibit 2, we can see that 16% of UK businesses – the highest proportion across geographies – advised they were ready for GDPR at the time the survey was conducted. With many more advising plans were well underway. In contrast, European businesses seem to be more certain of impact, but much further back in their preparation journey. Carrying on with the theme of certainty, however, no business leaders from Europe advised they didn’t know how plans were progressing. For all other geographies there are clear pockets of uncertainty, with North America and Asia-Pacific the most unsure regions.

Exhibit 2: Progress of organizations plans for GDPR by region

Source: HfS Research, 2018; N-300 Business Executives

It’s challenging to rationalize the two mindsets in the UK business world – with the highest uncertainty about impact, but also the highest levels of preparation. The paradox implies that many businesses are going along with GDPR for the ride, complying where possible, but are somewhat uncertain of the ramifications they can expect, at a strategic level. Coupled with little certainty over the impact of Brexit, the business environment in the UK seems particularly wary.

The bottom line:

UK enterprises may be the best prepared for GDPR, but the rest of the world has a better understanding of its impact to their business.

So, there it is, short and sweet analysis, right before the GDPR deadline – it’s likely Brexit means UK businesses are the most cautiously uncertain about the impact of GDPR on their business, while large enterprises in every other geography (including non-EU states) are more certain of the impact of the regulation. But the Brits are keeping calm and complying regardless.