The new framework, which is designed to strengthen and unify data protection for all individuals within the European Union (EU), will hand out tough punishments for those who fail to comply with new rules around the storage and handling of personal data. The regulation comes into force in May 2018, but nearly half (46%) of all SMEs bosses, representing more than 2.5million firms* in the UK have not even heard of it.
Furthermore, the GDPR will also introduce a duty on all organisations to report certain data breaches to the relevant supervisory authority and in some cases to the individuals affected, as well as giving customers the right to be forgotten which requires firms to erase all their information. This is a considerable step change and will affect many small and medium-sized organisations, particularly as recent industry figures** show that two thirds (66%) of SMEs have been a victim of cyber crime since their launch.
With data breach threats becoming an ever-growing concern for business leaders, Aldermore’s report, which surveyed over a thousand senior decision makers across the UK, reveals that more than a fifth (22%) of SMEs and their customers have been directly affected by a data breach in the past two years. More than half (55%) of business owners are concerned about cyber crime and the impact it might have on their firms, a further two in five (39%) SME bosses also anticipating that a cyber attack could have a significant financial impact on their business.
Surprisingly only a third (34%) of businesses see protection against cyber crime as a high priority and have taken steps to protect themselves, considering cyber-crime can involve something as simple as having business emails hacked and subsequent data stolen or intercepted. A further fifth (22%) realise it is an important issue but haven’t found the time to look into appropriate safeguards, with a further one in ten (12%) saying that they cannot afford to shield themselves adequately.
What is more surprising is that a quarter (25%) business owners say protection against cyber attacks is not an important issue for their businesses. The research also reveals that only a half (49%) of UK SMEs currently have data breach policies in place around the use of email, internet and mobile devices.
Carl D’Ammassa, Group Managing Director, Business Finance at Aldermore, said:
“The GDPR is the biggest shake-up in data protection to date and the results are worrying when looking at the amount of businesses that are unaware of the impact it will have on them. Data privacy, the appropriate use of customer information and breach notifications all need to be taken incredibly seriously. This is made especially apparent when one considers the increased sanctions businesses face if they don’t keep to the new regulations, include regular data protection audits, and fines of up to ?20 million or 4% of their annual turnover for the most serious violations.
“Moreover, we hope the EU’s new regulation achieves what it sets out to do and strengthens the resistance of businesses against the threat of a data breach. SMEs need to be clear on the use of customer information, ensure they are GDPR ready as soon as they can be and are aware of the impact this will have once it comes into effect in May next year.
“The danger of cyber attacks for all businesses, not just SMEs, is an ever present one and is something that is likely to increase as economic activity moves to the digital world. With these attacks having a significant financial and reputational impact on a business, it is crucial all SMEs take adequate time to analyse and protect themselves against this threat.”
