GDPR

While companies are turning to automation technology and analytics to meet their obligations under the EU's upcoming General Data Protection Regulation (GDPR), many are also relying on a rather low-tech solution to ensure compliance.

According to Veritas Technologies' 2017 GDPR report, most global companies are deploying employee training, coupled with incentives, legal obligations or the threat of disciplinary action, to spur their workforce to handle and manage data in a way that complies with the EU regulation.

The report is on a survey of 900 “decision makers” in organizations based in the United States, U.K., France, Germany, Australia, Singapore, Japan and the Republic of Korea with over 1,000 employees. Each organization has EU customers and will therefore be regulated by the GDPR once it comes online in May 2018.

Nearly two-thirds of respondents said they are moving to require their employees to receive GDPR training to help compliance with the EU regulation. Among those, at least 85 percent have prioritized training their IT and business direction and strategy employees, while 82 percent have prioritized training their legal and finance employees.

Though a majority of companies are focused on training their employees, they are approaching it in different ways: 40 percent look to educate their employees on the benefits of being GDPR compliant, 37 percent plan to educate their staff on the consequences of failing to do so.

What's more, 41 percent said they will implement disciplinary action should GDPR compliance be violated by an employees, while 25 percent would withhold employee benefits in cases of compliance violations.

Slightly over one-third also planned to offer rewards to employees for adhering to GDPR mandates.

Zachary Bosin, Veritas director of solutions marketing, noted that organizations are experimenting with “a carrot and stick approach” to ensure GPDR compliance. But he expected organizations in highly regulated industries to take “a more carrot-based approach” given that their employees are more familiar with meeting compliance standards. Other industries would likely lean more heavily on disciplinary action “because they really tried to build those compliance programs from the ground up.”

Beyond training, many organizations are also looking at more legal and operational ways to motivate their employees into GDPR compliance. Almost half said they would add compliance requirements to employee contracts.

Bosin noted that making employees legally responsible for GDPR compliance was typically done to “raise awareness” of the regulatory requirements and employee expectations. However, should noncompliance occur because of employee behavior, the organization would still shoulder have to the cost.

“The company is ultimately liable,” he said. “I have a hard time seeing a scenario in which, for example, an employee did something in terms of losing information and GDPR was enacted and the organization” could pass the liability on to an employee.

Meanwhile, only 31 percent were moving to restrict access to data to help enforce GDPR compliance. Such a move, Bosin said, would prove impractical, given the amount of data employees handle and store. Oftentimes, this occurs beyond the purview or grasp of the IT department. Therefore, while information governance processes and controls were important, they were not quick or easy fixes that could produce compliance in a short timeframe.

For many companies, adhering to the EU was also not just a matter of legal responsibility, but of good business. Ninety-two percent said compliance will improve data hygiene in-house, while 68 percent noted they will gain more insights into their data given by adhering to the regulation.

In addition, 59 percent believe that being GDPR-compliant will enhance their business brand, while 51 percent believe it will allow their organizations to more effectively protect their data in-house.