Fear and loathing about the European Union’s General Data Protection Regulation is apparently giving way to cautious optimism as organizations prepare for the new laws to take effect a week from Friday.

A new IBM Corp. survey released today finds that executive opinions toward the new privacy regulations are now broadly positive, even though the majority say their organizations won’t be ready in time.

The global survey of 1,500 executives responsible for their organizations’ GDPR preparations finds that 59 percent see the stiff new rules as “an occasion for transformation or a spark for new data-led business models.” That’s despite the fact that only 36 percent say they’ll be fully in compliance by the May 25 deadline.

GDPR replaces the European Union’s existing data protection standards with a set of uniform requirements that tighten controls over how much information organizations can collect about customers. Fines for noncompliance can run as high as €20 million, or up to 4 percent of a company’s total worldwide annual revenue.

Lemonade from lemons

Organizations that are taking the regulatory bull by the horns — a group the IBM Institute for Business Value calls “sparked” — have used the mandate to improve collaboration, streamline data management, improve security and forge closer customer relationships. They say the regulation has also given them a chance to review and improve security practices at a high level and also develop new data-based strategies to improve business functions.

Most of these proactive adopters also believe that practices that safeguard customer’s information can create a competitive advantage. Their opinion is in line with the results of a recent Harris Interactive Inc. poll of 10,000 consumers commissioned by IBM that found that 75 percent won’t buy from a company that they don’t trust to protect their data, regardless of the quality of the product.

Their opinions contrast sharply with organizations that are still struggling with the mechanics of compliance, a group IBV tags as “squeezed.” For example, nearly twice as many sparked as squeezed organizations report a high level of organizational collaboration. They also report higher levels of involvement in GDPR preparation by their security teams, directors, legal and line-of-business colleagues.

Most sparked organizations see GDPR is an opportunity to create a strong overall digital strategy and revisit security with a view toward creating more holistic practices covering privacy and data protection. Almost 30 percent say the rules will create new opportunities for data-led business models, compared with just 10 percent of squeezed respondents.

The more proactive group has also been more aggressive about creating new responsibilities for executives related to incident response (63 percent versus 37 percent) and run incident response simulations with executives (58 percent versus 38 percent).

Across the board, organizations are viewing the new regulation as a chance to do some spring data housecleaning. Eighty percent of all executives surveyed said they’re cutting down the amount of personal data their companies keep. And nearly as many report they’re tightening access controls and throwing away data that’s no longer needed.

Despite the generally positive attitudes overall, most organizations are still struggling with the details of implementation. The most problematic areas are performing data discovery, ensuring data accuracy, complying with new data processing requirements and updating privacy policies and notices. Even among the elite sparked group, only 57 percent said they’re prepared to develop and update privacy policies and notices.

Image: Unsplash