One in four businesses ‘unprepared’ for new data laws

And a third believe their companies will not be compliant in time for May 2018, when the EU General Data Protection Regulation (GDPR) comes into effect.


A quarter of marketers believe their companies are ‘unprepared’ and a third don’t expect to be compliant when new EU data laws come into effect in 2018, according to new data.

The survey from the DMA finds that awareness of the EU General Data Protection Regulation is increasing among marketers,rising by 53% to 66% since June 2016. Plus, marketers ‘personal’ feeling of preparedness has increased from 49% to 71% over the same period.

However, 26% believe their companies are not prepared and just 68% said their businesses would be compliant in time for the introduction of the new laws in May 2018.

READ MORE: What new data laws mean for marketers

Consent is the biggest area causing concern, cited by 70% of respondents, followed by legacy data on 50% and profiling on 37%. Marketers are therefore prioritising impact assessments, revising their data policies and giving data subjects greater control of their data.

Chris Combemale, the DMA’s CEO, says: “May 2018 should be a date that is in every marketer’s diary, giving us around 16 months before the GDPR comes into force.

“The finish line for GDPR readiness is fixed and the risk to businesses of not being compliant is significant. Our advice is to continue preparations in earnest over the coming year. Not making it across the line in time is not an option.”

The DMA also cautions that Brexit will not change the need for companies to be ready for GDPR. That is in part because the regulations will come into force before the UK leaves the EU, which is likely to be in 2019, but also because any business that has customers in Europe will still have to apply.

Plus, according to the research, 74% of marketers believe the UK should adhere to GDPR anyway, with 7% calling for stricter rules to be in put in place.

Combemale adds: “In an increasingly global digital marketplace, Brexit does not change the behaviours that companies must adopt in order to succeed and build long-term relationships with customers based on transparency and trust.”

  • Marketing Week will be hosting a workshop at Marketing Week Live on 8 March on getting to grips with GDPR. For more information and to book tickets head to



There is one comment at the moment, we would love to hear your opinion too.

  1. Paul Kennedy 15 Feb 2017

    While it’s not surprising that so many marketers are unprepared, it is somewhat reassuring that consent has been identified as the area of greatest concern.

    The implementation of ‘mechanics’ relating to the new regulations (such as breach notification) should be straight forward to put in place as they can be governed wholly by the Data Controllers and Data Processors. On the other hand, consent is, to a greater extent, in the hands of consumers.

    Customers will feel less resigned to handing over the data, and brands will have to work harder to set out a compelling proposition. For organisations that are fully compliant with existing data protection requirements and have a clearly articulated value exchange in place (ie, opt in and get something of value in return), the transition will be easier. In many cases however, ‘sins of the past’ have to be addressed first. Then, customers need to be introduced to new engagement models which make a positive case for opting in.

    It is right that marketers should be prioritising this area, but there is not much time. This cannot be switched on overnight. Without enough previous preparation, customer relationships will weaken, ultimately rippling though to the balance sheet.

Leave a comment