We would like to keep you up to date with the latest news from Digitalisation World by sending you push notifications.
Digital Newsletter
Each week our editor Phil Alsop rounds up the most popular articles, videos and expert opinions. We compile this into a Digital Newsletter and send it straight to your inbox every week.
Digital Magazines
We'll let you know each time a new edition of Digitalisation World is released so that you're always kept up-to-date with the latest and greatest news and press releases.
Video Magazines
The Digitalisation World Video magazine contains the latest Zoom interviews with experts in the industry.
Since the implementation of GDPR we have been in a honeymoon period. The frantic preparation stage has been replaced with prosecution and fines like those issued to BA and Marriott Hotels following their mega-breaches. However, we have yet to see how the UK Information Commissioner's Office will handle SMEs and public sector organisations.
The current picture – signs of a compliance gap
In the meantime, evidence is emerging that indicates many organisations are still falling short of their data privacy obligations. Figures vary, with some research claiming 30 percent of businesses are not yet GDPR-compliant, and others putting the percentage as high as 74 percent. A similar picture is building in the US, where only 14 percent of businesses are said to be compliant with the forthcoming CCPA. The trend is clear - organisations are struggling to meet their regulatory commitments. So, what is holding businesses and public sector organisations back and creating this compliance gap?
The shortage of qualified data privacy compliance professionals can be a challenge for many organisations. This issue was widely anticipated in the run-up to GDPR. In 2016, the International Association of Privacy Professionals (IAPP) predicted 28,000 privacy professionals would be needed to meet the GDPR requirements. One year after its implementation, they found half a million organisations have registered-data-protection officers in Europe, many serving multiple companies.
IAPP polled its members and found the average salary commanded by a qualified data privacy professional in Europe is just over £70,000 ($88,000). Taken together, these factors mean compliance professionals are scarce and their salary requirements put them out of reach of smaller companies and public sector organisations.
Their situration is further complicated by skilled compliance professionals who specialize in highly regulated industries, commanding a premium price. Recruiting a professional with skills at this level is overkill for the average SME, and more than public sector organisations can afford.
How can SMEs and public sector organisations address this challenge?
Data privacy regulation is here to stay. So organisations need to find a way to navigate this new normal, ideally as cost-effectively as possible. While there’s no getting around the fact that a business must develop its own privacy policies, data management and reporting, much can be gained from delegating the burden to outside experts.
For example, most organisations now use the cloud in one form or another to store, access, process, backup and archive data. Indeed, the public sector is now under a cloud-first mandate from central government. Cloud providers are acutely aware of their huge responsibility to keep their organisations up and running while complying with data regulations. If cloud providers want to offer services to some of the world’s most highly regulated industries, they must exceed the most stringent regulatory standards.
When it comes to GDPR and other regulatory compliance, SMEs and public sector organisations should expect their cloud service providers to deliver robust compliance with expert advice that can be applied throughout the business. They should be able to provide audit and reporting capabilities to address an organisation’s past performance as well as a continuous improvement roadmap to address evolving risks.
Effectively, by choosing a CSP with compliance expertise, businesses gain access to a wealth of specialist knowledge they can’t afford to employ in-house to overcome the skills shortage and avoid a compliance gap.
Growing complexity in the regulatory landscape
The global regulatory landscape is only going to grow in complexity as we see more examples of fines and legal action. Aside from the privacy element, the specific requirements for vertical sectors from government and healthcare to legal and finance introduce risk that businesses must address. With 49 percent of board directors naming changes in the regulatory climate as their top concern, organisations need to be confident that their partners are competent, accredited, and will strengthen their compliance posture.
For CSPs, compliance expertise should be a credible differentiator. Offering compliance consultancy that complements cloud services and provides added value to customers is a distinct advantage in building the trusted relationships at the heart of successful cloud service provision.
Frank Krieger is vice president of governance, risk and compliance at iland.
