10 Software and Cloud Services Providers to Consider for Your GDPR Compliance Needs
Total Page:16
File Type:pdf, Size:1020Kb
MARKET PERSPECTIVE 10 Software and Cloud Services Providers to Consider for Your GDPR Compliance Needs Andrew Smith Angela Gelnaw Carla Arend Duncan Brown Archana Venkatraman EXECUTIVE SNAPSHOT FIGURE 1 Executive Snapshot: GDPR Regulations Create New Opportunity Source: IDC, 2017 August 2017, IDC #US42277417 NEW MARKET DEVELOPMENTS AND DYNAMICS GDPR Accelerates Storage, Compliance, and Security Modernization GDPR enforcement begins May 25, 2018. The EU-wide regulation streamlines many of the complex local and regional regulations already in place and updates the laws around data collection and security to be more applicable and relevant to modern businesses using a range of cloud, mobile, and social technologies. From all the GDPR articles, IDC has distilled four major implications for organizations processing the personal data of EU-located data subjects: . Heftier noncompliance fines. The fine for noncompliance has been set at a maximum of €20 million or 4% of global revenue (whichever is higher). This takes noncompliance of personal data protection into anti-bribery and anti-money-laundering levels, making data protection a boardroom issue, not an IT issue. Mandatory notification of breach. Mandatory breach notification rules (common in the United States and other countries) are now introduced to the EU. A company must notify relevant authorities within 72 hours of discovering a breach and affected data subjects "without undue delay." This presents two challenges for organizations: the ability to effectively discover and document a breach quickly (most breaches are discovered months after they occur) and managing public relations after a breach. A company needs to plan for a breach and have a well-thought-out process not only for the technical remediation but also dealing with regulator, customer, and media concerns. Extra-territoriality. The GDPR contains an extra-territoriality clause, which extends its applicability to any data processor dealing with the personal data of EU citizens. This means that, for example, this regulation is applicable to a United States-based cloud service provider with no physical footprint in the EU if it processes EU citizen data. Social networks, ecommerce sites, and other internet-based companies are therefore included in the GDPR, making the regulations enforceable far beyond EU borders. Ban on data processing. In extreme cases, a regulator can suspend the right of companies to process personal data (see Article 58). This is effectively an order to cease trading since the processing of orders or the payment of employees typically involved processing personal data. Although it is unlikely that this sanction would be wielded often, it exists within the written law. This sanction will act as a backstop should all others fail and must be given serious consideration during any risk assessment associated with GDPR, since it has the potential to halt business operations entirely. Customers need distinct capabilities to address these challenges. For providers, simply branding products as GDPR-ready is unlikely to be sufficient or credible. Customers need help understanding how new regulations impact their data held on and off premises and how they can quickly identify what personal data is under their corporate umbrella and whether it is compliant with the GDPR. In some cases, these questions will lead to infrastructure modernization and new technology purchases, which can help organizations cost effectively adhere to GDPR regulations. However, there is still a significant amount of uncertainty and confusion surrounding GDPR enforcement. Technology and services providers have a unique opportunity to help customers identify the solutions and tools they need to become compliant, dispel the confusion and anxiety around GDPR compliance, and accelerate infrastructure and software modernization efforts in the name of improved data protection and security. ©2017 IDC #US42277417 2 Providers Can Help Customers Build a Business Case for GDPR Compliance The technology and services providers we spoke with indicate that many of their customers are ill- prepared to become GDPR compliant by the May 2018 deadline. A combination of uncertainty, lack of time, lack of funds, and aversion to change are responsible for customer unpreparedness. In response, vendors have released white papers, product maps, end-user surveys, and doomsday-style countdown clocks to remind customers of the impending changes and impact to their security, storage, and infrastructure strategies. Customers in highly regulated industries like finance and telecommunications typically have existing technology and processes in place, which may only need upgrades and modifications to meet the new requirements set forth by the European regulation. However, customers in other industries — such as manufacturing and retail — where high volumes of customer data have historically been collected under less stringent regulatory requirements, may find themselves scrambling to modernize their infrastructure and applications. For customers facing GDPR noncompliance issues, technology and services providers can act as an authority and valuable resource to help build the business case for GDPR-related solutions. Our discussions with providers uncovered several ways in which vendors are successfully partnering with customers to tackle GDPR compliance issues. These can be distilled into two basic approaches: providers can help dispel myths and uncertainty surrounding GDPR or providers can stress the necessity for both process and technology changes. Providers Can Help Dispel Myths and Uncertainty Surrounding GDPR GDPR presents unique positioning opportunities for many vendors. Under GDPR, service providers that store or process personal data will be subject to legal and regulatory obligations because of their status as a "data processor." This means that the burden of GDPR compliance does not lie solely with the customer, or the "data controller," as they are known under GDPR law. Customers using a cloud services provider to store, collect, or access customer information or run cloud-based applications that store or access customer information will rely on their service provider to help achieve GDPR compliance. IDC has identified several areas where vendors can give guidance regarding new GDPR regulations and help customers execute necessary changes. Combined with internal and external legal counsel, this will help vendors establish a reputation as a trusted partner during the formation of GDPR-related policy and technology decisions. To do so, vendors can focus conversations with their customers and partners around the following areas: . GDPR is just one piece of the data protection puzzle. Data protection is a continuum, with tools for data archiving, backup, security, recovery, and compliance all contributing to increasingly mature levels of protection. Most customers looking to address GDPR will have existing tools for compliance and data protection in their environment. The key opportunity is for providers to help map the requirements of GDPR to the customer's existing fabric of data protection tools and processes and identify the areas where infrastructure and software optimization are necessary to improve the customer's data protection maturity. Finally, achieving GDPR compliance should not be seen as a binary end state; once a customer reaches "compliance," providers should help work with customers to anticipate future needs and stay ahead of legal and regulatory changes. Customers should not take a "wait and see" approach. Providers should be sure to discuss the risks of noncompliance with customers. One large cloud services provider we spoke with estimates that half of its customers in the EU are actively planning their GDPR compliance ©2017 IDC #US42277417 3 needs and have a team and plan in place to address issues. The other half — customers without a significant plan in place — are hoping they will be able to avoid fines by responding reactively as initial lawsuits and enforcement are doled out by the authorities. Providers must encourage customers to be proactive with GDPR compliance. Realistically, authorities will have to take a strategic, targeted approach to GDPR enforcement at the outset because of lack of time and resources. Authorities won't be able to fine everyone, so it will be possible for some firms to avoid litigation in the short term. However, the financial and public relations ramifications associated with GDPR noncompliance could be catastrophic for some firms. Every organization will make a risk assessment for GDPR and calculate the costs and benefits of compliance. Technology providers can help influence these assessments and incentivize customers to take a proactive approach to GDPR solutioning, despite the cost and time necessary to execute changes. Do not let uncertainty around vague requirements lead to decision paralysis. Many providers we spoke with indicated there was confusion with customers regarding how/when some GDPR articles will be enforced. One such rule is the 72-hour breach notification requirement. Vendors and their customers question how this policy will be enforced and how uncertainty around unknown/undiscovered breaches will impact reporting. Providers can help clarify that only "personal data breaches" must be reported, which is narrower than security breaches generally and narrower than "data breaches." Furthermore, it is essential to help customers understand that notification requirements differ for