•  One Year To Go Before Far-Reaching Rules Are Introduced 
•  Poll Reveals Significant Lack Of Awareness And Urgency Within The Sector

Less than half (47%) of financial services businesses in Britain have started preparing for the new wide-ranging data protection rules which come into force in less than a year’s time – despite 12% admitting the maximum fine for non-compliance would force them out of business and 9% saying it would lead to large scale redundancies.

According to a YouGov survey of 285 financial services businesses, which was commissioned by national law firm Irwin Mitchell, only 56% admit to being aware of the new General Data Protection Regulation (GDPR) which comes into force on 25 May 2018.

GDPR represents the biggest change in 25 years to how businesses process personal information and it replaces existing data protection laws.

Under the new rules, the maximum fine for certain data breaches in the UK will rise from £500,000 to €20million or 4% of global turnover, whichever is larger.

Forty five per cent of financial services firms are unaware of the new fines and 12% say they would go out of business if they received the maximum punishment. Nine per cent think they would need to make significant job cuts with a further 30% admitting that smaller scale headcount reductions will be necessary.

Joanne Bone, partner and data protection expert at Irwin Mitchell said: “These results are concerning because with next May’s deadline fast-approaching and with so much at stake, our study reveals there’s a very real possibility that a large number of financial services companies  will not be compliant in time.

“The financial services sector has significant data protection issues to tackle, particularly as more people move towards conducting their banking activity online. Financial institutions collect vast amounts of data which has to be treated carefully and the Regulator considers financial information to be more serious than everyday data.”

The notification of certain data breaches where there is an impact on privacy, such as a customer database being hacked or a letter being put in the wrong envelope, must be reported to the Information Commissioner’s Office within 72 hours under the new regime.

However, Irwin Mitchell’s survey found that just over one third (36%) of financial services firms are certain that they would be able to detect a data breach within their organisation. Just 41% say they are confident they would notify the relevant stakeholders within the required timescale of three days.

Other changes under the GDPR include an obligation to be more transparent about how personal data is used. Businesses will also need to have processes in place in case an individual asks for all their personal data to be erased.

Irwin Mitchell believes the low level of awareness of GDPR is caused by a number of misconceptions that exist about the new rules and say this has led to a level of complacency.

This view is supported by 25% of respondents, who claim that GDPR will have no impact, say it is not an issue for their sector. Nineteen per cent claim it isn’t relevant to their business as they are not a consumer business.

The reality is that the rules encompass a wide range of personal data including employee data, payroll and pension records. They also apply to data in a business context where individuals are concerned, such as sole traders and partnerships.

Irwin Mitchell’s Joanne Bone added: “Contrary to popular belief personal data is not just consumer information.It is hard to think of a business today that does not use personal data. Whether you have employee data, customer data or supplier data – if the data relates to an individual you will be caught by the new data protection laws.”

The survey revealed that only 29% of financial services businesses view the new data protection rules as an opportunity and 19% said the rules will have a positive impact on their organisation.

Commenting on this finding, Stuart Padgham, partner & National Head of Commercial at Irwin Mitchell, said: “It is important to recognise that taking a proactive approach towards GDPR compliance will potentially reap financial benefits.  Good data governance can build customer trust and the right permissions can also help businesses take advantage of the Big Data Revolution and enable them to commercialise their data for competitive advantage.”