The effects of General Data Protection Regulation on the IT industry?

We expect that GDPR will bring back part of the data to the EU. Data controllers will give preference to local data center providers in the courtiers where personal data is collected as it will decrease the amount of paperwork and reduce the risk to be penalized. And here Jelastic meets the needs of customers partnering with 25 service providers that have data centers in EU and well-conceived processes of data collecting.

From the other hand, the majority of data controllers (i.e. website owners, mobile app developers, SaaS solutions) should improve both technical and legal aspects of personal data security within their companies to be compliant with GDPR and avoid fines.

In cloud industry, we will notice increasing demand on migration services and bigger attention to lock-in issue as many companies will have to shift from untrusted public clouds that are not compliant to domestic data center providers or even to on-premise private clouds. The demand for hybrid and multi-cloud will also grow.

The most impactful provision in my line of work is the 72-hour breach notification requirement: when a breach of customer data occurs, you have 72 hours to report it. That is really fast. Hackers don't put up a sign telling you when they broke in and what they stole. It can take weeks or months to figure out exactly what they did, and in particular, which customers are affected and in what way. This is why you often see a company make an initial breach disclosure that says X accounts were affected, then later the company changes the number of accounts to Y. It's unclear how the industry and regulators will deal with the uncertainties of a real-life breach investigation.

Small incidents, like sending a customer's info to the wrong email address, happen a lot but are relatively easy to handle. Realistically, a large breach that impacts customer data is a very rare event, one which most companies will never experience. But you still have to prepare for it. This requires establishing expedited investigation procedures, ensuring tools gather all needed information, drafting notification templates and/or having legal counsel on call, and establishing clear criteria for deciding when to perform a notification. You'll also want to practice it a few times.

I think broadly across the industry there is support for the idea of breach notification, especially unified across a large region like the EU rather than piecemeal in every country. Various US states and countries already have disclosure requirements for various types of incident, and unifying them can be beneficial. But there is a lot of concern both about the 72-hour timeline, which is really tight, and how the rules will be enforced. I personally expect that we'll see a large number of precautionary disclosures that are later revised, causing confusion among the public. I also expect the regulators will find some people to demonstrate that their new law has teeth. I expect they'll find no shortage of qualifying incidents that were not properly reported by second-tier companies that do not have the sophisticated incident management capabilities of the tech giants.