Published by Gbaf News
Posted on May 11, 2016
7 min readLast updated: January 22, 2026
GDPR challenges all organisations to mask EU data by default
Delphix, the market leader in data virtualisation, has issued a strong warning for organisations to re-architect operations and adopt a secure, data-first approach ahead of the introduction of the European General Data Protection Regulation (GDPR). The approval of the GDPR means businesses that store or process European data will be forced to build data protection into system design and infrastructure, or risk fines of up to 4 per cent of global turnover. In particular, organisations need to closely examine the security of non-production data that is used to develop and test systems. Independent research has highlighted that up to 90 per cent of non-production data currently sits unmasked within organisations, posing a significant security and compliance risk.
“The GDPR introduces a punitive structure, similar to the measures introduced to prevent price fixing in competition laws, that puts the risk of non-compliance into sharp focus,” said Iain Chidgey, vice president, international sales, Delphix. “In the last few years, we’ve seen blue-chip companies pay hundreds of millions in fines for price-fixing scandals and it’s even forced non-compliant firms into administration. The GDPR risks having the same effect, so companies must have a complete view of their data, treating non-production data with the same security profile as live data.”
The GDPR requires enhanced data security measures to ensure compliance, in particular referencing the use of “pseudonymisation.” This is the process of masking confidential data in such a way that it can no longer be attributed to an individual – protecting the data should it ever fall into the wrong hands.
The GDPR also incentivises data masking at several different points:
“The volume of data copies that are sprawled across non-production environments will require technology that can efficiently protect all data, not only those bits of information that are the most sensitive,” continued Chidgey. “To meet future requirements for data protection, the first step will be understanding where all the data sits in IT environments. The second step will be embracing a new wave of IT innovation to support compliance and reduce the risk of a data breach but without slowing down projects. Combining data masking with data virtualisation is one way organisations can scale up to the security levels that the GDPR requires, ensure compliance and distribute data quickly to accelerate critical business initiatives.”
“The GDPR introduces a carrot and stick approach to promoting data masking. At several points throughout its text, it encourages businesses to adopt pseudonymisation technologies, either as part of good information management or by reducing regulatory burdens in the event of unforeseen events, like security incidents. Contrasted against that, companies that are not in compliance with the GDPR face regulators waving a very big stick – potential fines of up to four per cent of annual worldwide turnover. That’s a very big incentive to do things right,” concluded Phil Lee, a partner in the Privacy, Security and Information team at international law firm Fieldfisher,
Lee breaks down the legal jargon around GDPR pseudonymisation in a new paper here.
Read the blog post by Jes Breslaw, Delphix EMEA director of strategy, for additional background on the impact GDPR will have to customers.
GDPR challenges all organisations to mask EU data by default
Delphix, the market leader in data virtualisation, has issued a strong warning for organisations to re-architect operations and adopt a secure, data-first approach ahead of the introduction of the European General Data Protection Regulation (GDPR). The approval of the GDPR means businesses that store or process European data will be forced to build data protection into system design and infrastructure, or risk fines of up to 4 per cent of global turnover. In particular, organisations need to closely examine the security of non-production data that is used to develop and test systems. Independent research has highlighted that up to 90 per cent of non-production data currently sits unmasked within organisations, posing a significant security and compliance risk.
“The GDPR introduces a punitive structure, similar to the measures introduced to prevent price fixing in competition laws, that puts the risk of non-compliance into sharp focus,” said Iain Chidgey, vice president, international sales, Delphix. “In the last few years, we’ve seen blue-chip companies pay hundreds of millions in fines for price-fixing scandals and it’s even forced non-compliant firms into administration. The GDPR risks having the same effect, so companies must have a complete view of their data, treating non-production data with the same security profile as live data.”
The GDPR requires enhanced data security measures to ensure compliance, in particular referencing the use of “pseudonymisation.” This is the process of masking confidential data in such a way that it can no longer be attributed to an individual – protecting the data should it ever fall into the wrong hands.
The GDPR also incentivises data masking at several different points:
“The volume of data copies that are sprawled across non-production environments will require technology that can efficiently protect all data, not only those bits of information that are the most sensitive,” continued Chidgey. “To meet future requirements for data protection, the first step will be understanding where all the data sits in IT environments. The second step will be embracing a new wave of IT innovation to support compliance and reduce the risk of a data breach but without slowing down projects. Combining data masking with data virtualisation is one way organisations can scale up to the security levels that the GDPR requires, ensure compliance and distribute data quickly to accelerate critical business initiatives.”
“The GDPR introduces a carrot and stick approach to promoting data masking. At several points throughout its text, it encourages businesses to adopt pseudonymisation technologies, either as part of good information management or by reducing regulatory burdens in the event of unforeseen events, like security incidents. Contrasted against that, companies that are not in compliance with the GDPR face regulators waving a very big stick – potential fines of up to four per cent of annual worldwide turnover. That’s a very big incentive to do things right,” concluded Phil Lee, a partner in the Privacy, Security and Information team at international law firm Fieldfisher,
Lee breaks down the legal jargon around GDPR pseudonymisation in a new paper here.
Read the blog post by Jes Breslaw, Delphix EMEA director of strategy, for additional background on the impact GDPR will have to customers.
Explore more articles in the Technology category
