New consent rules, broadened European privacy rights, fines going up to millions of euros, as well as stricter procedures and public disclosure in cases of a data breach \u2013 these are just some of the changes that will come into force as part of the General Data Protection Regulation (GDPR) in May 2018.<\/p>\n
Despite the significance of these changes, many companies have no idea what is coming their way with little more than a year to go until the deadline. As demonstrated by an IDC Research survey<\/a>* conducted on behalf of ESET, a quarter (25%) of the 700 surveyed European companies admitted they were not aware of GDPR and more than half (52%) of them were unsure of the impact on their organizations.<\/p>\n Even after shifting the focus to those that were aware of the regulation, the picture didn\u2019t improve that much. Every fifth (20%) firm in the survey hadn\u2019t begun preparing for GDPR yet, close to 60% were still getting their systems in line with the new rules, leaving only 21% ready for the changes.<\/p>\n This is surprising; mostly in regard to the potential consequences businesses will face in case of non-compliance. Nowadays, costs of data breaches appear to remain in the lower six-figure range, at least according to IDC\u2019s survey. A quick comparison with the coming penalties may put the near future into perspective.<\/p>\n 35% of the organizations that suffered a data breach in the last two years reported losses of between \u20ac25,000 and \u20ac250,000, and most (32%) put losses between \u20ac10,000 and \u20ac25,000. However, fines and rules on public disclosure imposed by GDPR can potentially increase financial risks after May 2018 to millions of euros.<\/p>\n The new regulation sets maximum fines to as high as \u20ac20 million or 4% of a company\u2019s annual turnover if the company violates GDPR rules relating to breaches of data protection principles, conditions for consent, customers\u2019 or employees\u2019 rights or international data transfers.<\/p>\n This means a significant increase in risk, but the regulation itself also suggests \u201cproper means\u201d that can help businesses mitigate them. Encryption<\/a> is named as one of the technologies that can help protect data and ease some of the obligations.<\/p>\n Also, costs for implementing encryption at SMBs \u2013 starting around tens of euros per seat per year \u2013 are significantly lower than the potentially devastating fines companies face under GDPR.<\/p>\n In this regard, with only a year left until GDPR enters into force, IDC has also looked into the state of encryption and its use amongst the surveyed businesses. It found that file encryption has been implemented in 46% of firms and is desired by 36%. Compared to that, full-disk encryption is reportedly in use in only 38% of the companies, and desired by a third of them (34%).<\/p>\n