In the two months following GDPR, 68% of businesses have failed to wipe the memories of old IT equipment before disposal, putting them at risk of fines.
Despite GDPR legislation having come into effect over four months ago, the majority of UK businesses are now risking penalties by failing to adhere to some of the rules.
According to a survey of 1,002 UK workers in full or part-time employment, carried out by Probrand.co.uk, the majority (68%) of businesses have failed to wipe the data from IT equipment they have disposed of in the two months following GDPR.
This news is perhaps less surprising given the research also found that 70% of businesses do not have an official process or protocol for disposing of obsolete IT equipment.
What’s more, 66% of workers admit they wouldn’t even know who to approach in their company in order to correctly dispose of old or unusable equipment.
Worryingly, according to the data, transportation businesses – many of which will have customer and client addresses and contact information on their systems – are the most guilty of this.
72% of these types of businesses have been guilty of this in the months following GDPR.
Businesses within sales and marketing (62%) – many of whom will also have access to public data – were the second most guilty of this.
The top 10 industries which are most guilty of not clearing the memory of IT equipment before it is disposed of:
- Transportation – 72%
- Sales and marketing – 62%
- Manufacturing – 59%
- Utilities – 58%
- Retail – 57%
- Education – 54%
- Leisure and travel – 49%
- Healthcare and hospitality – 45%
- Trades/administration – 44%
- Information and communication – 39%
Matt Royle, marketing director at Probrand.co.uk commented, “Given the amount of publicity around GDPR it is arguably impossible to be unaware or misunderstand the basics of what is required for compliance. So, it is startling to discover just how many businesses are failing to both implement and follow some of the simplest data protection practices.
“The fines involved in a GDPR breach can potentially run into the millions – and what appear to be less tangible impactors, like reputational damage, customer trust and loyalty, will ultimately become financially significant.
“Given these findings, it is clear that more needs to be done to ensure that all businesses have a disposal procedure in place to avoid inadvertently leaking sensitive data.”
