New FOI data reveals how businesses blundered before GDPR

The request submitted by Redscan yielded some interesting and seriously shocking results

GDPR readiness

The majority of UK businesses filed either late or incomplete reports to the Information Commissioner's Office (ICO) following the discovery of a data breach in the year prior to GDPR's implementation.

That's according to data from a Freedom of Information (FOI) request by Redscan, which revealed that the average time between the breach occurring and the report being filed was three weeks for UK businesses, with the worst offender filing it a staggering 142 days following the breach.

What's worse, it took one business 1,320 days to even realise it had been breached, while on average it only took general businesses 60 days to detect a breach.

To further highlight the necessity for the GDPR, now domestically enshrined in law by the Data Protection Act 2018, the FOI data shows that the vast majority (91%) of reports to the ICO failed to include important information such as the impact of the breach, the recovery process and dates of key events.

Advertisement
Advertisement - Article continues below

The report also echoed a long-thought belief that many businesses would declare data breaches at the end of the week, either on a Thursday or Friday, to avoid widespread media coverage, despite most incidents occurring on a weekend.

"Detecting and responding to breaches is now a 24/7 effort. Many organisations lack the technology and expertise they need, which is compounded by a global cybersecurity skills shortage," said Mark Nicholls, Redscan director of cybersecurity. "Resources are stretched even further at weekends, when many IT teams are off-duty - exactly why hackers chose to target businesses out of hours.

"It's also interesting to note that nearly half of reports to the ICO were submitted on a Thursday or a Friday, good days to bury bad news. This might be overly cynical but I suspect that in many cases, breach disclosure on these days may have a deliberate tactic to minimise negative publicity."

Data found that the legal and financial industries were far more successful at identifying data breaches early on, with an average of 25 and 37 days respectively. Redscan believes this is likely due to a heightened regulatory awareness in both sectors.

Incidents in these industries were also reported to the ICO far quicker, with legal taking 20 days on average, and financial 16 days - that's compared to the 27 days of general businesses.

"Data breaches are now an operational reality, but detection and response continue to pose a massive challenge to businesses," said Nicholls. "Most companies don't have the skills, technology or procedures in place to detect breaches when they happen, nor report them in sufficient detail to the ICO. This was a problem before the GDPR and is an even bigger problem now that reporting requirements are stricter.

"It's incredibly optimistic to think that businesses are better at preventing and detecting data breaches since the introduction of the GDPR," he said. "Despite the prospect of a larger penalty, many are still struggling to understand and implement the solutions they need to achieve compliance."

There is a stark juxtaposition in the reporting procedures of businesses post-GDPR. Back in September 2018, the ICO said how businesses were over-reporting data incidents.

Receiving 500 calls per week, a third of these were considered to be unnecessary and/or failed to meet the necessary threshold of a data incident. It's amazing what the threat of a massive fine will do.

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Most Popular

Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/mobile/mobile-phones/354273/pablo-escobars-brother-launches-budget-foldable-phone
Mobile Phones

Pablo Escobar's brother launches budget foldable phone

4 Dec 2019
Visit/network-internet/wifi-hotspots/354283/industrial-wi-fi-6-trial-reveals-blistering-speeds
wifi & hotspots

Industrial Wi-Fi 6 trial reveals blistering speeds

5 Dec 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019