The document summarizes the results of a survey conducted by Flavourfy Digital in Dorset, UK on data security practices among local businesses. Key findings include: nearly a third of respondents either do not access email securely or are unsure if they do; 11% have never checked if their website software is up to date; and over half have yet to consider how new GDPR regulations will impact their business. The report concludes many businesses are unprepared for growing cybersecurity and data compliance challenges and urges them to implement appropriate policies and procedures to protect themselves.

1. State of Data Security
in Dorset 2017
ǍFlavourfy Digital

2. © Flavourfy Digital 2017
Introduction
State of Data Security
In Dorset 2017
These are the results of a recent survey carried out by Flavourfy Digital in Dorset, at the end of
2016 and beginning of 2017. They represent a snapshot of how businesses in the Dorset area are
tackling issues relating to the security of their business, their data and the protection of their
customers.
With cyber security risks on the rise, the introduction of new data protection legislation in 2018
and growing use of digital technologies within businesses across the UK, there’s no better time
for data security issues to be at the top of the agenda for any sized business.
Whilst the results confirm a mixed response to general data security issues, there is still an
apparent lack of engagement in some areas, particularly take up of Cyber Essentials and
preparing for the GDPR.
We hope you find the results both interesting and helpful.
Mark Gracey
Founder, Flavourfy Digital
April 2017

3. © Flavourfy Digital 2017
Summary
State of Data Security
In Dorset 2017
• Whilst the majority of respondents access their email over a secure connection, nearly a third either
don’t or didn’t know whether they did or not
• Nearly two thirds of respondents use the WordPress platform for their website (known to have regular
security updates and to be the target of vulnerability attacks) and yet 11% of respondents had never
checked they were running on the latest version of website software and only 39% knowingly regularly
scanned their website for security issues
• A third of respondents store personal data using cloud services and over half allow their employees to
access cloud services via a mobile device, but less than a quarter have turned on 2-factor
authentication for added security
• Only 5 respondents had been Cyber Essentials accredited (a UK Government back cyber-security
accreditation scheme) or checked to the standard of Cyber Essentials
• Just over half of respondents have yet to consider the GDPR’s impact on their business. The GDPR is a
new EU regulation that is likely to impact most businesses when it becomes UK law in May 2018
• 46% of respondents have no internal policies and procedures within their businesses to control their
security, use of digital and data protection compliance

4. © Flavourfy Digital 2017
Methodology
State of Data Security
In Dorset 2017
Online Survey
across Dorset
Businesses
82 Respondents
15 Questions

5. © Flavourfy Digital 2017
Demographics
State of Data Security
In Dorset 2017
BH1 6 BH21 3
BH2 1 BH22 2
BH4 1 BH23 4
BH5 1 BH24 1
BH6 4 BH25 2
BH7 3
BH8 7 DT1 7
BH9 3 DT2 4
BH11 2 DT4 2
BH12 2 DT11 2
BH13 2
BH14 6 SO14 1
BH15 3 SP6 1
BH18 1
BH19 2
BH20 91 2 - 5 6 - 25 26 - 50 50 - 250 >250
Business locationsBusiness sizeƓ

6. © Flavourfy Digital 2017
Email Security
State of Data Security
In Dorset 2017
Do you collect your
email over a secure
connection?
30% of
businesses either
not using secure
email connections
or don’t know if
they are
Yes No Don't know I don't use email

7. © Flavourfy Digital 2017
Website Software Updates
State of Data Security
In Dorset 2017
When was the last time
you checked whether
there were any software
updates for your
website?
63% had checked
their website software
for updates recently or
had someone check for
them
11% had
never checked their
website software
for updates
62% of
respondents use
WordPress
(software know for
regular security
updates)
Ɓ

8. © Flavourfy Digital 2017
Website Security
State of Data Security
In Dorset 2017
Do you regularly scan
your website for security
issues?
30% don’t regularly scan
website for security issues
Yes daily No Don't know Someone does it for me
Ɓ62% use WordPress a
popular CMS known to be
targetted by hackers

9. © Flavourfy Digital 2017
Website Backups
State of Data Security
In Dorset 2017
Do you keep back-ups
of your website?
70% YES
5% backed up
to the website only
(i.e. no external
backups)
ƽ
13% NO
17% rely on
hosting provider
backups (i.e. don’t
have a local copy of
their own)
10% didn’t
know if they took
backups or not

10. © Flavourfy Digital 2017
Cloud Storage
State of Data Security
In Dorset 2017
32% of
respondents store
personal data in
the cloud
23% of
respondents are
using 2-Factor
authentication for
their cloud storage
55% of
respondents allow
employees to
access cloud
storage via mobile
devices

11. © Flavourfy Digital 2017
Cyber Essentials
State of Data Security
In Dorset 2017
Has your business
been audited using
the Cyber Essentials
scheme?
2% Cyber Essentials
accredited
Yes No Don't know No, but we've used something else
0% Cyber Essentials
Plus accredited

12. © Flavourfy Digital 2017
GDPR Preparations
State of Data Security
In Dorset 2017
What's your business
doing to prepare for
the new EU General
Data Protection
Regulation (GDPR)?
Nothing yet Currently running internal audits
We’ve hired a consultant It's not relevant to us
We're leaving the EU so not relevant
51% of
respondents have yet
to think about whether
they’re affected by the
GDPR that becomes UK
law in 2018

13. © Flavourfy Digital 2017
Polices & Procedures
State of Data Security
In Dorset 2017
46% of
respondents had
no data protection
or security policies
or procedures in
place
32% registered with
the ICO
27% have a data
protection policy
21% have an
acceptable use policy
22% have a website
update policy
18% have a
password policy
13% have a cloud
storage policy
Ƅ 9% have regular
data protection
training
9% have regular
cyber security briefings

14. © Flavourfy Digital 2017
The Future
State of Data Security
In Dorset 2017
Speaking with businesses and service providers on a daily basis there’s a real feeling that most business owners have their heads in the sand when it comes to data
protection and online security – the survey results don’t really bear that out so clearly, but they do still highlight issues around business approaches to digital security
and compliance.
The next two years for the UK are going to be challenging ones for Dorset businesses (and UK ones for that matter). In May 2018 a new data protection regime will
take hold in the form of the GDPR. It will introduce new measures to protect EU citizens’ data with particular focus on positive consent for processing, larger fines and
a requirement to report data losses and breaches. Furthermore, there’s a good chance that at the same time the EU will introduce a new ePrivacy Regulation that
could just impact the way B2B businesses market their products and services. Every business could really be impacted by these changes and now is the time to make
sure that your business is prepared. But as the survey results show we’ve a long way to go until Dorset businesses wake up to these data protection and privacy
challenges. We’ve also got to think about the impact Brexit could have on data protection in the UK and the uncertainty it could bring if we’re seen as a third country
and have to prove our data protection credentials to continue to do business across the EU.
The cyber-security problem isn’t going away either. With the British Chamber of Commerce reporting in April 2017 that 1 in 5 business have fallen victim to a cyber-
attack, it’s time for Dorset businesses to wake up to prevention being as good as a cure. Educating employees about the risks is as much part of the solution as
technical ones and there are some really simple processes to put in place that will mitigate the risk. Everyone is at risk, and the feeling that it will ‘never be me’ is
clearly a false prophecy.
On the data security front the real challenge is to educate business owners about the problems of relying on technology without fully getting a sense of the risks –
going for the easy solution at the cost of business security. Good examples of this in the survey are the number of businesses storing business data in the cloud, but
yet, not using 2-factor authentication, and the number of WordPress users measured against the number of businesses not keeping their website software up to date
or reviewing website security.
Undoubtedly, we’ll hear of more and more horror stories where businesses are being caught out by cyber-risk or compliance failure over the coming months. The
solution is simple – put in place adequate policies and processes and make sure you protect your business by educating your teams.
Get it right and not only will your business be protected but you’ll build your business’s brand and reputation as your customers and potential customers come to
realise you take security and compliance seriously.
If you need help understanding the data security risk to your business or are unsure about how the GDPR will impact your customer data, get in touch:
info@flavourfy.co.uk or 07833 297193.

15. State of Data Security
in Dorset 2017
ǍFlavourfy Digital