More than 40 per cent of Irish organisations do not have plans in place to deal with possible data breaches, while 13 per cent don’t even know where the customer information they have collected is stored, according to a new survey.
The research, which was undertaken by IT security firm Ward Solutions, also shows local businesses remain woefully unprepared for General Data Protection Regulation (GDPR), which comes into effect next year.
GDPR is the most comprehensive data protection legislation to be passed in the history of the European Union. The regulation governs the privacy practices of any company handling EU citizens' data. It also requires that public authorities and certain companies processing personal data on a "large scale" must have an independent data protection officer.
According to the study, while 74 per cent of the 170 organisations surveyed collect personal data on customers, thereby making them subject to GDPR, more than one quarter of them either had no awareness of the legislation or had not started preparing for it. This is despite the fact that companies who fail to achieve compliance under the new legislation face fines of up to €20 million.
Penalties
The survey also shows close to a third of company directors were not aware of the extent of possible fines, with 20 per cent unaware that penalties existed.
"It's extremely worrying that, with little over a year to go until GDPR comes into force, almost half of Irish businesses still don't have a plan to deal with data breaches. The incoming penalties for failing to display compliance in the aftermath of a data breach are so significant they could have a devastating effect on companies found to be non-compliant, both financially and in terms of reputational damage," said Pat Larkin, chief executive of Ward Solutions.
“Irish businesses must act now to ensure compliance, and it is essential to their future viability that directors do not underestimate the workload that this involves,” he added.
