Identity Theft News

Data security compliance costs plague firms

Wednesday, September 16, 2009

Costs of compliance and number of vendors with access to sensitive information are cited by a majority of businesses as stumbling blocks to preparations for new data security regulations taking effect in Massachusetts next March.

According to a survey conducted by Goodwin Procter and the International Association of Privacy Professionals (IAPP), companies face major challenges in complying with the state’s data security rules that impose significant requirements on entities possessing personal information of state residents, including entities based outside Massachusetts.

The survey revealed that 60 percent of information privacy professionals say their organizations have more than 10 vendors with access to personal information and 30 percent say they have over 100 vendors with access to personal information - which complicates the compliance process.

Complying with the new regulations is also costing 33 percent of respondents more than $50,000. Another 12 percent of those surveyed say their organizations have spent between $10,000 and $50,000 and 44 percent have spent more than 100 hours in compliance activities.

Although the cost of compliance is significant, other research indicates that data breaches are far more costly to contain. In 2007, the average cost of a data breach was $6.3 million, according to a Ponemon Institute study released earlier this year.