Almost one-third (32%) of organisations that use third-party IT retirement companies may be exposed to huge fines under the impending General Data Protection Regulation (GDPR) legislation. This is according to Irish secure IT retirement company, AMI, who today revealed the results of a survey of senior IT decision-makers in Ireland.
The research finds that 77% of Irish companies say they would be seriously affected by data theft from old equipment, with 8% saying they would go out of business. Despite this, the AMI survey finds that 32% of companies that use third-party IT retirement companies don’t get formal confirmation that their data has been completely erased.
The survey reveals that many Irish companies have overlooked the risk posed by failing to properly dispose of end-of-life IT assets. Some 47% of those surveyed stated that they manage data-destruction themselves and wipe or physically destroy data on site.
As well as this, a quarter of respondents said that end-of-life IT assets remain on their premises for more than one year, highlighting that many organisations do not have established processes in place for managing the disposal of old IT equipment.
Of those organisations that do have established processes for handling end-of-life assets, just over half (52%) send retired assets to a third-party specialist. A further 43% donate the equipment to employees, schools or charities.
AMI warn that GDPR will introduce more stringent guidelines around where data flows and how it is processed. In the event of a data breach or compromise, companies who are unable to account for the whereabouts of their data could face fines of up to 4% of global turnover or €20 million, depending on which is greater. This will require companies to closely review supplier processes and policies to safeguard their interests warns the organisation.
However, according to the survey results, 39% of those who work with a third-party IT retirement provider never audit the provider’s security processes.
Commenting on the research, Managing director at AMI, Philip McMichael said, "It is extremely clear from the results of this survey that Irish organisations are leaving themselves vulnerable at the end-of-life stage by failing to securely manage the retirement of their old IT assets. Companies need to establish processes for disposing of this equipment and dramatically reduce the amount of time that it spends in storage, as this increases the risk of data going missing. It also devalues the equipment, so it’s in companies’ own interest to manage this process effectively."
Source: www.businessworld.ie
