Information exchanges: regulatory changes to the cyber-security industry after Brexit: Making security awareness training work

Abstract

The incoming EU General Data Protection Regulation (GDPR) requires companies to notify the EU authorities of data breaches within 72 hours. Currently, just 28% of cyber-attacks are reported to the police, cites the Institute of Directors, despite half of these attacks causing disruption to business operations. 1 , 2 This demonstrates a clear need for increased transparency across the EU, and is heralded as an excellent move by the European Commission. By not reporting these crimes, businesses are depriving both law enforcement agencies and other companies of insights that could be gained from each incident. This is one of many pan-European initiatives, designed to increase data sharing, co-operation and regulation that benefit the UK. The incoming EU General Data Protection Regulation (GDPR) demonstrates a clear need for increased transparency across the EU at a time of escalating threats. Yet the UK's vote to leave the EU has created some considerable confusion as to how UK companies should respond. To meet the compliance and data protection challenges, companies must make sure they are prepared to implement the necessary steps to continue operating and meet the requirements of changing legislation, explains Elad Sharf of Performanta.