See how you stack up against your peers and gain insights into how companies are addressing the formidable challenges of privacy in 2021.

1. 1
1
© 2021 TrustArc Inc. Proprietary and Confidential Information.
TrustArc Global Privacy
Benchmarks Survey 2021
May 26, 2021

2. 2
2
Objectives
TrustArc’s 2021 Global Privacy Benchmarks Survey builds on last year’s inaugural survey with a 360○
view into
several key privacy developments:
● Priorities and strategic approaches to data privacy and security
● Top challenges large enterprises face in privacy management
● Year over year evolution of the 7 Keys to Privacy and 5 Outcomes that Matter
● Understanding what privacy solutions the market is using
Methodology
Golfdale Consulting has been conducting the Global Benchmarks Survey on behalf of TrustArc, and based on our
intent to obtain a balanced 360○
view, they weighted respondent level results across four primary roles:
● Executives
● Managers
● Full time (non-managerial) employees, and
● Privacy team members

3. 3
3
2021 Report
What We Are Going to Show You
02
Steady, hard work led to
significant improvements
01
Pandemic challenges
did not stop privacy
progress
03
Despite improvements,
much remains to be
accomplished

4. 4
4
Company Revenue Size
YoY
22%
31%
22%
10%
11%
27%
40%
28%
3% 1%
Over US $5 Billion $1B to $5B $501M to $999M $51M to $500M $50M or less
2020 2021
Panel surveys were focused exclusively on enterprises
with annual revenue +500M with the remaining
responses coming through social channels.
From a baseline of 1503 responses in 2020, this year’s
fieldwork was successful in boosting responses to 1600+.

5. 5
5
34%
26% 25%
15%
1% 3% 1%
41%
38%
18%
3% 2% 2% 1%
US Europe United
Kingdom
Canada Latin
America
Asia
Pacific
Middle
East and
Africa
51% 53%
45%
39%
27%
21% 19%
67%
62%
50%
37%
33%
28%
25%
Europe US United
Kingdom
Canada Asia Pacific Latin America Middle East
and Africa
2020 2021
Operating Regions and Head Office
Operating Regions
Head Office

6. 6
6
Privacy Team Composition
Privacy Office
67%
83%
22%
7%
12%
10%
2020
2021
Yes No Don't know / Not sure
Does your company have a dedicated
Privacy Office?
5%
10%
14%
22%
17%
32%
6%
8%
16%
18%
20%
32%
Part of legal/or compliance team
but not the formal privacy team
No direct role in managing privacy
Not part of privacy team but I help
ensure policy and procedures
Executive
Privacy team member
Privacy team lead
2021
2020
Which of the following statements best describes your role as it relates to
the privacy office or team at your company?
An increasing number of enterprises have
created formal Privacy Offices in 2021.

7. 7
7
Privacy Focus
15%
29%
25%
22%
9%
100% -- I spend all of my
time on company-wide
privacy initiatives.
66% to 99% -- I spend most
of my time…
34% to 65% -- I spend a
considerable portion of my
time…
1% to 33% -- A portion of
my time…
0% -- No time other than
ensuring I follow policies
and procedures.
What percentage of your time is typically spent on privacy-related initiatives or matters?
Two thirds of the respondents spend anywhere from
“considerable” to “all of their time” on privacy initiatives.

8. 8
8
Top Privacy Risks 2021
51%
34% 34%
30% 30% 30% 29% 28% 27%
24% 23%
20%
15%
7%
Cybersecurity
risks from
third parties
or attackers
Reputational
risks from
data breaches
Compliance
risks from
regulatory
oversight and
penalties
Adopting new
national
regulations
that may be
introduced in
2021
Third-party
risk and
resilience in
your Supply
Chain
Management
Threats from
within by
employees
Challenges in
systems
integrations
Reputational
risks from
social media
Complying
with recent
regulations
that have
been put into
force or will
be in 2021
Implementing
new cross-
border data
transfer
mechanisms
across
geographies
Political risk Maintaining a
patchwork of
separate local
privacy
compliance
requirements
Maintaining a
patchwork of
privacy
solutions vs. a
wholistic
approach
None of the
above
Of the following challenges that many enterprises face, which would you describe as top privacy risks that your company is likely to encounter in 2021?
(Choose all that apply.)
Cybersecurity is a clear “stand out” challenge among many
privacy threats that large enterprises encounter.

9. 9
9
Privacy Vulnerability
Suffered in Past 3 Years
34%
27%
25% 24% 23%
21%
11%
Data breaches Large scale
cybersecurity attacks
Regulatory
investigations, actions
or fines
Data privacy lawsuits
from consumers
None of the above Adverse media
scrutiny
Don't know/Not sure
Has your company suffered from any of the following in the past 3 years? (Choose all that apply.)
Data breaches are the #1 vulnerability in terms of what
companies have suffered over the past 3 years. Perceptions of
what constitutes regulatory “actions” differ significantly by role.

10. 10
10
Keys to Privacy

11. 11
11
TrustArc Global Privacy Index
The 7 Keys to Privacy
 Making sure privacy permeates day to day business decisions with great importance
 Having the Board of Directors regularly review and discuss privacy matters
 Pursuing privacy as a core part of business strategy
 Embracing privacy practices as a key differentiator
 Being mindful of privacy as a business
 Ensuring every employee can formally raise a privacy issue with confidence that there will be no reprisal
 Sufficiently training employees in privacy matters

12. 12
12
1st Key: Privacy Importance
YoY and Geography
2%
2%
1%
9%
6%
6%
49%
44%
39%
39%
47%
53%
Europe
United Kingdom
US
Which of the following statements best represents how your organization approaches privacy, in terms of levels of
importance in how it affects day to day business decisions?
2%
3%
8%
11%
44%
41%
46%
45%
2021
2020
Not important /few decisions Somewhat important/some decisions Important/many decisions Great importance/almost every decision
The US leads other geographies in
embracing privacy issues.

13. 13
13
Keys to Privacy
4% 3% 4% 2% 4% 3% 3% 2% 2% 2% 3% 4%
13% 11% 12% 11%
16% 13% 8% 8% 8% 9% 13% 11%
50% 50% 46%
42%
47% 50%
48% 47% 50% 50%
50% 50%
33% 37% 37% 44%
33% 34% 42% 43% 40% 40% 33% 35%
Strongly
agree
Agree
Disagree
Strongly
disagree
With “Don’t know…” removed
Privacy competence improvements Y0Y.
2020 2021 2020 2021 2020 2021 2020 2021 2020 2021 2020 2021
Sufficiently training
employees on
privacy matters
Employee
confidence in no
reprisal on raising
privacy issue
BOD regularly
reviews and discusses
privacy issues
Embracing
privacy as a key
differentiator
Core part of
business strategy
Mindful of
privacy as a
business

14. 14
14
TrustArc Global Privacy Index
The 5 Confidence Outcomes that Matter
 Confidence your company is able to keep all employees and customers relevant data secure and protected
 Confidence your customers/clients have in your management of data privacy
 Confidence your employees have in your management of data privacy
 Confidence your partners/third parties have in your management of data privacy
 Confidence the general public has in your management of data privacy

15. 15
15
Overall Confidence
Geography
How confident are you that your company is able to keep all of your employees and your customers' relevant data secure and protected?
[excludes “Don’t know/Prefer not to answer”]
The US leads other geographies in
overall “complete” privacy confidence.
From 2020 to 2021 respondents increased
their level of confidence from 73% to 78%
feeling a great deal or complete confidence.
Complet
e
confiden
ce
31%
Great
deal of
confiden
ce
51%
Complete
confidence
25%
Great deal of
confidence
58%
Complete
confidence
24%
Great deal of
confidence
50%
US
UK
Europe

16. 16
16
Overall Confidence
YoY and Geography
1%
1%
1%
2%
1%
2%
1%
4%
3%
5%
3%
6%
4%
4%
5%
21%
21%
17%
19%
27%
26%
21%
20%
45%
45%
47%
44%
41%
42%
47%
47%
29%
30%
29%
33%
23%
27%
26%
28%
2020
2021
2020
2021
2020
2021
2020
2021
No confidence Very little confidence Some confidence A great deal of confidence Complete confidence
How much confidence do you think these key stakeholders have in your company's management of data privacy?
[excludes “Don’t know/Prefer not to answer”]
Partners and
third parties
The general
public
Our employees
Our customers
Modest confidence gap holds
across all key stakeholder groups.

17. 17
17
TrustArc Global Privacy Index
Grand Mean measured from -100 to +100
Privacy initiatives have resulted in global
improvement in the TrustArc Global Privacy Index.
49% = 25th
Percentile
70% = 50th
85% = 75th
Percentile
2020 2021

18. 18
18
Do More?
YoY and Geography
When it comes to privacy, we should be doing much more [excludes “Don’t know/Prefer not to answer”]
7% 6% 9% 6%
21% 21%
24%
20%
44% 49% 37%
43%
29% 25%
30% 32%
2021 Europe United Kingdom US
Strongly agree
Agree
Disagree
Strongly disagree
Despite improvements YoY, 73% of respondents
believe their companies can do more.

19. 19
19
Privacy Solutions

20. 20
20
Primary Solution
YoY Changes
6%
16%
11%
19%
20%
27%
9%
20%
13%
21%
17%
20%
We have not used any
technology solutions to
manage our privacy
programs
Spreadsheets, email
and/or word processing
software
Free or open–source
privacy software
solutions
Internally developed
system
Governance, Risk and
Compliance (GRC)
software
Privacy management
software
2021
2020
What primary solution do you use to manage your privacy program? [excludes “Don’t know/Prefer not to answer”]
There is an increased use YoY of Privacy
Management software.

21. 21
21
Global Privacy Index: Executive Scorecard
Executive Viewpoints
58
61
63
65
72
80
Free or open–
source privacy
software
solutions
Spreadsheets,
email and/or
word
processing
software
Internally
developed
system
We have not
used any
technology
solutions to
manage our
privacy
programs
Governance,
Risk and
Compliance
(GRC) software
Privacy
management
software
What primary solution do you use to manage your privacy program?
Executives that have Privacy Management Software score highest on the TrustArc
Global Privacy Index. Progress in implementation is key to gaining privacy competence.
31
37
40
68
84
We have no
current plans
We are in the
planning stages
We have started
our
implementation
Our
implementation
is well underway
Our
implementation
is fully done
… please indicate the state of implementation
at your company in 2021: Strategic and
reportable privacy program management
Global Privacy Index Score By Solution Set Global Privacy Index Score By Implementation Phase

22. 22
22
46%
43%
41%
40%
39%
38%
36%
36%
33%
37%
38%
38%
40%
36%
39%
39%
16%
14%
15%
17%
16%
20%
17%
17%
6%
6%
6%
6%
5%
5%
8%
8%
Data breach notification
Up-to-date data privacy and regulatory information
Comprehensive understanding of the cookies & trackers found on your website
Easily managing consent preferences
Data discovery
Streamlining privacy assessments including Privacy Impact Assessment (PIA)
Automating data subject requests (DSRs)
Data privacy management
Very effective Somewhat effective Neutral Somewhat + Very ineffective
Effectiveness
Please rate the degree to which your privacy solution is effective in providing the following:
Overall data privacy management is viewed as an area where
companies are least effective compared to other privacy initiatives.

23. 23
23
73%
64%
45%
24% 25%
46%
31%
15%
7%
2%
Fully done Well underway We have
started our
implementation
We are in the
planning stages
We have no
current plans
Cookie Consent
Implications
Cookie consent implementation and effectiveness is strongly correlated with
Overall privacy competence as measured by our Global Privacy Index.
1%
5%
15%
38%
41%
8%
19%
39%
61%
78%
Very ineffective
Somewhat
ineffective
Neutral
Somewhat
effective
Very effective
Effectiveness
Privacy Index Score
Effectiveness and
Global Privacy Index Score
Please rate the degree to which your privacy solution is effective
in providing the following: Comprehensive understanding of the
cookies & trackers found on your website
For each of the following privacy initiatives, please indicate the
state of implementation at your company in 2021: Cookie consent
Implementation and
Global Privacy Index Score

24. 24
24
23%
41%
43%
46%
46%
46%
47%
We work with key
stakeholders from
different departments
to ensure that our
consent solution not
only meets regulatory
requirements but also
our business objectives.
...Is in plain language
(not legalese) that is
easily understandable.
...Is consistent with our
brand's tone of voice
and style.
...Applies the highest
global standard in all
the jurisdictions that
we operate.
...Dynamically displays
the language based on
the website visitor’s
location.
...Meets the baseline
regulatory
requirements.
...Enables us to build
trust with our
customers.
Cookie Consent
Our Cookie Consent solution…
Thinking specifically about your company’s cookie consent approach, which of the following best describes your company’s approach (choose all that apply).
The vast majority of companies do NOT approach cookie consent
as a means to meet business objectives beyond reg requirements.

25. 25
25
Knowledge of Regulations

26. 26
26
Regulatory Compliance
CCPA Compliance LGPD Compliance
Which of the following statements best describes the state of your compliance with CCPA? …LGPD [excludes “Don’t know…”]
5%
9%
22%
29%
14%
15%
17%
17%
20%
16%
22%
14%
2021
2020
We are done and are
fully compliant with
CCPA.
Our implementation
is well underway.
We have started our
implementation.
We have a plan in
place but have not
started
implementation.
We are working on
our plan.
We have not started.
5%
21%
15%
20%
20%
19%
We are done and are
fully compliant with
LGPD.
Our implementation
is well underway.
We have started our
implementation.
We have a plan in
place but have not
started
implementation.
We are working on
our plan.
We have not started.
Compliance improved YoY.

27. 27
27
17% 13%
27%
18%
29%
25%
30%
32%
31%
34%
27%
30%
13%
15%
10%
11%
6% 8%
3% 5%
5% 6% 3% 4%
2021 Europe United Kingdom US
Over 2 years
19 to 24 months
13 to 18 months
7 to 12 months
3 to 6 months
Less than 3 months
Time to Compliance
On average, how long does it take your organization to become compliant with a new privacy law?
Almost half of respondents believe they
can achieve compliance within 6 months.

28. 28
28
75%
68% 68%
62% 57% 56%
37% 36%
76%
64%
69%
58%
57% 56%
40% 40%
80%
57%
84%
54%
48% 50%
29% 29%
75% 76%
63%
69%
60% 58%
36% 35%
GDPR LGPD UK GDPR/DPA CCPA GLBA PIPEDA APPI HIPAA
2021 Europe United Kingdom US
Knowledge Rankings
How would you rate your knowledge of the following privacy laws as it pertains to your business? If the particular regulations do not apply
to your business, please choose this option, irrespective of your knowledge of it. * “Does not apply…” removed
Top
2
Box
“Very
knowledgeable”
+
“Knowledgeable”
The UK stands out with highest awareness of local regulations. There
were ~5% improvements YoY on all knowledge measures.

29. 29
29
2021 Report
02
Steady, hard work led to
significant improvements
01
Pandemic challenges
did not stop privacy
progress
03
Despite improvements,
much remains to be
accomplished
What We Showed You

30. 30
30
2021 Whitepaper Report
In-depth report available
June 2, 2021

31. 31
31
Thank You