GDPR compliant? Sinequa investigates maturity levels in large organisations

In beginning of 2020, Sinequa, a recognized leader in the AI-powered search and analytics market, commissioned the market research institute, Sapio Research, to conduct a survey in Germany, France and Great Britain on the status of their preparations for the implementation of data protection measures. The survey covered 752 people from companies of all sizes in all key sectors (telecommunications with 27%, financial sector with 18% and manufacturing with 14%). IT managers (38%), executives (28%), C-level (21.5%) and other decision-makers (10.5%) were surveyed.

35% of the surveyed organisations have already received an inquiry from regulatory authorities and individuals regarding personal data within the past two years, with Germany clearly (- 14%) lagging behind in terms of inquiry volume. By far the largest number of inquiries were directed at companies in the energy and telecommunications sectors. The focus tends to be more on B2C companies than on those from the B2B environment. Most GDPR-related inquiries came from regulatory authorities, followed by (in equal parts) customers, employees and suppliers. Most demands concern the right of access to stored personal data (70%), followed by a request for deletion (61%).

In terms of data management and compliance, each nation considers itself to be the leader. In Great Britain, for example, 70% of those surveyed believe their country is a pioneer, while in Germany only 9% think this about the British. Conversely, neither the UK or France are seen as leaders in this field by their competitors. In terms of respondents in all countries, Germany is rated as the country with the highest score in terms of GDPR maturity level - explained by a number of legal data protection regulations dating back to before the new EU regulations.

In order to improve their compliance with GDPR, over the past two years more than half of the companies have carried out global initiatives such as awareness raising, employee training and the introduction of new processes/solutions. Almost all companies operating in European markets have now appointed data protection officers. Often, however, the actual data management still lies with the CIOs. Looking at current initiatives within organisations, two approaches can be clearly identified:

- the checklist approach, which consists of doing the minimum necessary (hiring a data protection officer and reviewing key processes) to "check off" requirements.

- the governance approach, which rethinks the data management strategy as a whole. The larger the organisation, the more important this strategic aspect becomes.

Respondents identified the most significant remaining challenges as collecting personal data (47% of respondents), achieving full visibility of unstructured data (44%), establishing the right data modeling flows (42%) and identifying and locating personal data (41%). Only 41% of respondents said they had truly 100% visibility across all their data.

Download Whitepaper GDPR: https://go.sinequa.com/Large-Enterprises-in-year-II-of-GDPR.html.