GDPR Puts Response at Center Stage for All Companies

The European Union's (EU) GDPR marks the most important change in data privacy regulation in the past 20 years. While it gives individuals better peace of mind regarding their personal data, it also creates new pressures for companies that operate in Europe. For example, GDPR mandates strict parameters and complex reporting procedures. To have a prayer of meeting these, organizations should begin preparing now.

The impact

GDPR’s impact is global: any organization – whether based in the EU or not – is subject to GDPR when they offer goods or service to data subjects in the EU or collect data concerning any EU citizen. The penalty for non-compliance is large: Failure to notify supervising authorities and data subjects of a breach within 72 hours could result in fines of €20 million or up to 4% of a company’s global annual revenue. This is not the kind of spend that a CIO or CEO wants to defend to their board of directors.

If you think 72 hours seems pretty short you’re right. After all, according to a recent study, the average time to respond to an incident is still a challenge. Forty-one percent of the respondents to a Ponemon Institute study said the time to resolve a cyber incident either increased significantly or increased from 2015 to 2016. Now imagine the pressure to not only identify a breach within three days, but to notify all of the right authorities.

Most organizations have room for improvement when it comes to cyber response: Another Ponemon study found that as many as three in four organizations admit they lack a formal cyber security incident response plan applied consistently across the organization. That study further explains that data breaches have become a consistent "cost of doing business" for companies, which might explain the lack of enthusiasm for investing in a formal plan.

Getting prepared

The preparation process should start now. Particularly in light of the short time frames and hefty fines, starting early will go a long way for when GDPR goes into effect next year. The scope of GDPR will require complex reasoning and decision-making, and a very comprehensive notification process that may span continents and multiple authorities. An example of how confusing this can be: If your company is not headquartered in the EU, but have two different offices in the EU making decisions on processing data, it could be unclear which authority you’ll need to report breaches to.

GDPR response, therefore, will need to orchestrate not only technology, but also people and processes.

GDPR adds a new set of challenges for any company doing business in Europe, and the next 12 months will go by much sooner than we think. The far-reaching provisions and stiff penalties will put a company’s bottom line at stake and put the most complex part of managing cyber incidents – response – under the microscope. However, companies that begin properly preparing and practicing now to make their data breach response GDPR-compliant will be ready for the GDPR challenge next spring.

Ted Julian is vice president of product management and co-founder of IBM Resilient.