This document discusses the challenges organizations face in complying with the General Data Protection Regulation (GDPR) by its deadline of May 25, 2018. It notes that GDPR is a regulation that must be applied entirely across the EU and includes severe fines for noncompliance. The document presents survey results showing that most Italian organizations have a roadmap to meet the deadline but still struggle with requirements like data transfers outside the EU, data protection officers, and consent management. It concludes that GDPR challenges are more related to changing processes than technology and that organizations must align security budgets to the risks they most fear.

1. Data Privacy & The Golden Age of Security
IDC Security Conference
Milano, 10 Maggio 2018

2. Agenda
Evolving threats scenario
GDPR challenges
Impacts on Security Budget
2

3. Two-year transition deadline: 25 May 2018
Severe fine
It is a
regulation
Sensitive data
and extra-
territoriality
Data breaches
notification
Individual
rights are
strengthened
Accountability
and DPO
It applies to
processors
too
A regulation is a binding legislative act. It
must be applied in its entirety across the
EU, while a directive is a legislative act that
sets out a goal that all EU countries must
achieve (it is up to the individual countries
to decide how).

4. Comparing the challenges with Western Europe
13%
14%
30%
32%
39%
39%
40%
41%
47%
48%
50%
53%
55%
12%
20%
32%
38%
45%
47%
48%
38%
29%
39%
42%
70%
60%
0% 20% 40% 60% 80%
DATA TRANSFERS TO COUNTRIES OUTSIDE OF THE EU
APPOINTING A DATA PROTECTION OFFICER
MOBILE FIRST STRATEGIES MAKE IT MORE DIFFICULT TO TRACK CUSTOMER DATA
OBTAINING PERMISSIONS FOR TESTING/ANALYTICS OF REAL CUSTOMER DATA
SERVICE A PERSON'S DATA ACCESS REQUEST
DATA MINIMIZATION PRINCIPLE
DEFINING DATA USE CASES AND MANAGING CONSENT
RIGHT TO BE FORGOTTEN (RTBF)
DEFINING WHAT 'STATE OF THE ART' MEANS
DATA PORTABILITY
DATA PROTECTION BY DESIGN AND BY DEFAULT
DATA BREACH NOTIFICATION WITHIN 72 HOURS
ENCRYPTION AND/OR PSEUDONYMIZATION OF DATA
GDPR Most Demanding Requirements
Italy (n=100) WE (n=560)
Source: IDC's Western Europe GDPR Survey, 2017

5. No idea.
What that?
3%
Just starting
22%
Roadmap to
deadline
63%
Already
compliant
11%
© IDC 5
What is happening in Italy?
Roadmap to deadline
73% Large Biz vs. 62% Small Biz
75% Finance vs. 55% Manufacturing
55% Centro vs. 39% Nord Ovest

6. With GDPR is time for household cleaning …
Source: IDC Italy, 2018 (n=398 )
2%
11%
21%
46%
34%
30%
54%
51%
68%
15%
65%
17%
0% 15% 30% 45% 60%
IT INFRASTRUCTURE INNOVATION/
RENEWAL
IMPROVEMENT OF QOS
IMPROVEMENT OF IT SECURITY
RATIONALIZATION/ CONSOLIDATION
AUTOMATION/ OPTIMIZATION
IT COST REDUCTION
GDPR Status & IT Priorities
Already compliant Just started

7. © IDC 7
GDPR vs Long-term Vision: what is impacting more
on IT Security budget allocation

8. Concluding remarks
8
Unprecedented IT risk: dangerous tools approaching the
public domain
GDPR challenges related more to processes than
technology
Aligning budget to perception: what do you fear the most?

9. 9
IDC Italia
Viale Monza 14
20127 Milano
Tel: +39 02 28457339
gvercellino@idc.com
Giancarlo Vercellino
Research & Consulting
Manager
IDC Italy
www.idc.com