What’s it all about?
Since May 2018, all UK businesses were required to be GDPR compliant if they obtain, store and process personal data. The regulations were put in place to protect against data breaches, but it has left many businesses at risk of claims against them from the ICO (Information Commissioner) and/or private individuals.
However,it is currently estimated that over 75% of UK businesses are still currently not GDPR compliant and are at risk of a regulatory fine or being sued by clients for not keeping their data safe. Most of these businesses even believing that they have taken amicable steps to protect customer data.
The risks to your business
The ICO has the power to fine companies up to 4% of their turnover for data breaches. Over £1 billion in fines have been issued by regulatory bodies since GDPR was introduced. So far, over 37,000 businesses have failed to protect their customers’ data and are liable to be fined.
Nearly half of all UK adults questioned expressed plans to activate their new rights if their personal data had been leaked. It is estimated that average compensation amounts for personal claims can range from £750 to £10,000 per data subject.
Claims of these sizes could potentially close your business; can you afford not to act?
Examples of common Data Protection Breaches:
Database hacking – accounts for an estimated 21% of all data breaches
Cardskimming and finance attacks – Payment hackers and cyber criminals are stealing £190,000 every day
Clerical Errors – Employee mistakes are so easy, an email to the wrong person could be costly
Compromise or loss of personal devices – One lost USB stick cost Heathrow Airport £120,000 in fines
Staff theft of data – Your employees may be financially encouraged to sell your customer data
Learn your GDPR blind spots and protect against future claims.
GDPR fines, penalties and claims for compensation from customers pose a financial risk to your business and as with any risk, accounting provisions can be made to cover these costs. According to the 2006 Companies Act every UK business needs to mitigate risk and make provisions to recognize that risk.
Once a director is made aware of this risk, it is their fiduciary duty to mitigate this risk, and this is where a “GDPR monetary compensation fund or reserve” comes into play.
The benefit of recognizing this risk
As a result of reflecting this risk in your accounts, you may be able to reclaim up to 2 years tax for your “GDPR Compensation Fund” in preparation for such claims by building a provision into your company accounts. The provision is then adjusted every year going forward to reflect the extent to which the risk has changed.
