There are fewer than nine months before the EU's new data protection rules take effect. Companies that don't comply face steep fines. Are you taking all these recommended steps to ensure compliance?

Come next May, companies in the EU/EEA – and all companies outside the region that manage the personal data of EU/EEA citizens – will have 72 hours to disclose any serious data breaches to the relevant authorities and to the individual concerned. Failure to comply with the EU's General Data Protection Regulation (GDPR) will come with stiff financial penalties for companies: failing to notify authorities and individuals of a data breach will cost the company up to €10 million or two per cent of revenues and failure to comply with GDPR's rules comes at the higher penalty of up to four per cent of annual global turnover or €20 million, whichever is greater.

Only 6% prepared for GDPR

It seems there has never been more urgency for companies to really get on top of their cyber security and data protection strategies. The UK's National Cyber Security Centre said earlier this month that Britain's top companies and charities need to do more. It said that:

• only six per cent of businesses are completely prepared for GDPR;
• two-thirds of bosses at Britain’s biggest businesses are not trained to deal with a cyber attack; and
• one in 10 FTSE 350 companies operate without a response plan for a cyber incident.

One online security firm, Nuvias Group, is spelling out how companies should tackle GDPR. The company's cyber security executive vice-president, Ian Kilpatrick, writes in an online article: “The ability to ensure confidentiality, integrity, availability and resilience will be crucial – as will be restoring data in a timely manner in the event of an incident. Organisations will need a process for testing and evaluating the effectiveness of their security processes, meaning they will need to demonstrate they have taken adequate steps to protect the data.”

Eight steps to GDPR compliance

Kilpatrick makes the following suggestions of how companies can start to prepare for GDPR:

1. Talk to your IT providers about core data security solutions.
2. Your talks with IT providers should include the following areas:
   • encryption,
   • access and identity management,
   • two-factor authentication,
   • application control,
   • intrusion prevention and detection,
   • URL filtering,
   • APT blocking and
   • data loss protection.
3. Don't neglect your network and secure all wireless access points.
4. Have a demonstrable security policy in place and make sure employees are fully trained in the correct security practices.
5. If you are a larger organisation or public body, you will need to appoint a data processing officer.
6. A variety of corporate departments should be involved, including legal, HR and IT.
7. Insurance will be affected as there will be more emphasis on liability and who is to blame for a data breach.
8. Businesses are also advised to document everything they have done on GDPR compliance at a technical and policy level to show due diligence.

Kilpatrick concludes: “With heavy financial and reputational risk threatening, the sooner the new regulations are adopted, the more confident a company can be that it will not be found wanting when GDPR comes into effect.”