Published by Gbaf News
Posted on April 24, 2018
7 min readLast updated: January 21, 2026
McDermott-Ponemon GDPR Survey Shows that Almost Half of Companies Don’t Expect to Have Adequate GDPR Processes in Place by May Deadline
A major survey sponsored by international law firm McDermott Will & Emery and carried out by the Ponemon Institute has revealed that many companies are behind schedule to achieve Global Data Protection Regulation (GDPR) compliance by the looming May deadline. The survey results show that 40% of companies only expect to achieve compliance with the regulation after May 25th when the Regulation comes into effect.
The McDermott-Ponemon study surveyed companies across the US and Europe on their understanding of the impact of GDPR and their readiness for it. Key findings of this important benchmark survey are:
“There is a lot more work to be done for GDPR readiness, this study shows. These findings reflect the demanding nature of GDPR and the anxiety around complying with it,” said Mark Schreiber, McDermott partner and a leader of the Firm’s Global Privacy and Cybersecurity Practice. “A key issue here is prioritizing what can be done in the remaining time before that May deadline and acting on those high risk areas.”
“Compliance is more than just updating your privacy policy, and so it is heartening to see so much wholesale change to workflows and an appreciation that business-as-usual processing will change after May 25,” said Ashley Winton, McDermott London partner and Chairman of the Data Protection Forum. “However, it is particularly interesting to see which sectors are making the most effort to get into compliance, as it is not just consumer or retail facing companies. With markedly disparate levels of compliance expected by May 25, it will be interesting to see what the regulators response will be.”
The survey shows that companies are investing heavily in attempting to achieve GDPR compliance. The average annual budget for compliance is $13 million according to the findings – a figure that one in three companies expects to review annually. More than one in five (22%) believe that a budget allocation will continue indefinitely in their organization due to a need to continue with investment in technologies, governance practices and staffing. Respondents believe that the majority of the budget will be spent on Managed Services (28% of spend), followed by Personnel (19% of spend) and technology (17% of spend).
“The risks of failing to comply with GDPR have been most often reflected by organizations’ fear of the potential size of the financial penalties that non-compliance could bring about,” said Larry Ponemon, founder of the Ponemon Institute. “The headline figures – fines of up to €20m or 4% of global turnover, whichever is the greater amount – represent a potentially massive fine for companies.”
The full survey results can be accessed and downloaded here: The Race To GDPR: A Study of Companies in the United States and Europe.
For additional details on the EU’s Global Data Protection Regulation and model GDPR policies and templates, please visit www.mwe.com/GDPR.
McDermott-Ponemon GDPR Survey Shows that Almost Half of Companies Don’t Expect to Have Adequate GDPR Processes in Place by May Deadline
A major survey sponsored by international law firm McDermott Will & Emery and carried out by the Ponemon Institute has revealed that many companies are behind schedule to achieve Global Data Protection Regulation (GDPR) compliance by the looming May deadline. The survey results show that 40% of companies only expect to achieve compliance with the regulation after May 25th when the Regulation comes into effect.
The McDermott-Ponemon study surveyed companies across the US and Europe on their understanding of the impact of GDPR and their readiness for it. Key findings of this important benchmark survey are:
“There is a lot more work to be done for GDPR readiness, this study shows. These findings reflect the demanding nature of GDPR and the anxiety around complying with it,” said Mark Schreiber, McDermott partner and a leader of the Firm’s Global Privacy and Cybersecurity Practice. “A key issue here is prioritizing what can be done in the remaining time before that May deadline and acting on those high risk areas.”
“Compliance is more than just updating your privacy policy, and so it is heartening to see so much wholesale change to workflows and an appreciation that business-as-usual processing will change after May 25,” said Ashley Winton, McDermott London partner and Chairman of the Data Protection Forum. “However, it is particularly interesting to see which sectors are making the most effort to get into compliance, as it is not just consumer or retail facing companies. With markedly disparate levels of compliance expected by May 25, it will be interesting to see what the regulators response will be.”
The survey shows that companies are investing heavily in attempting to achieve GDPR compliance. The average annual budget for compliance is $13 million according to the findings – a figure that one in three companies expects to review annually. More than one in five (22%) believe that a budget allocation will continue indefinitely in their organization due to a need to continue with investment in technologies, governance practices and staffing. Respondents believe that the majority of the budget will be spent on Managed Services (28% of spend), followed by Personnel (19% of spend) and technology (17% of spend).
“The risks of failing to comply with GDPR have been most often reflected by organizations’ fear of the potential size of the financial penalties that non-compliance could bring about,” said Larry Ponemon, founder of the Ponemon Institute. “The headline figures – fines of up to €20m or 4% of global turnover, whichever is the greater amount – represent a potentially massive fine for companies.”
The full survey results can be accessed and downloaded here: The Race To GDPR: A Study of Companies in the United States and Europe.
For additional details on the EU’s Global Data Protection Regulation and model GDPR policies and templates, please visit www.mwe.com/GDPR.
Explore more articles in the Business category
