Are we there yet? Understanding the challenges faced in complying with the General Data Protection Regulation (GDPR)

1 INTRODUCTION

• The GDPR applies to personal-data handling across digital media and can punish enterprises anywhere in the world for mistreating EU citizens’ data.It also aims to provide a comprehensive template for data protection, not only punitive enforcement.Source: §1 · p. 1
• Organisations faced serious difficulty understanding what GDPR compliance means and how to implement it, prompting this study of feasibility around its implementation.The paper frames feasibility as important to assessing and improving data-protection legislation.Source: §1 · p. 1
• The study examines how organisations interpreted the regulation, translated it into technical practice, sought support, and verified compliance.It also investigates their awareness of GDPR and expectations about enforcement.Source: §1 · p. 1
• Compliance was generally considered doable, but large organisations and security-focused SMEs made more mature attempts than other SMEs, for whom compliance could strain resources.This divide also produced different attitudes toward compliance expectations and feasibility.Source: §1 · pp. 1–2

2.1 GDPR Awareness

• 43% of Finnish data controllers were aware of GDPR, and about 31% of all data controllers were willing to act; a UK study reported 38% business and 44% charity awareness.The studies are not directly comparable because the UK study did not limit its sample to data controllers; policies and procedures were the most common changes reported there.Source: §2.1 · p. 2

2.2 Preparing for the GDPR

• Earlier GDPR analyses outlined obligations such as consent, documentation, and data protection by design, but did not give direct advice on overcoming implementation problems.IoT-focused work also discussed transparency, data minimisation, and risk-based distinctions between sensitive and non-sensitive data.Source: §2.2 · p. 2
• Prior research warned that SMEs could struggle with GDPR’s volume and that its qualitative provisions could permit too much flexibility.IoT research also raised concerns about GDPR’s ability to improve privacy practices.Source: §2.2 · p. 2
• A readiness survey found compliance budgets could approach $50 million for one company, while data mapping and tagging remained primarily manual and some GDPR terms needed clarification.Most respondents were multinational corporations, and the analysis identified privacy management, third-party processors, and breach disclosure as major concerns.Source: §2.2 · p. 2
• A survey of FTSE 350 and Fortune firms reported substantial compliance budgets, but it excluded SMEs.Another report found only a fifth of organisations considered themselves fully compliant and cited GDPR complexity as the primary difficulty.Source: §2.2 · pp. 2–3

2.3 Research Motivation

• Although GDPR aims to centralise and demystify data-protection practice, debate persists, and the regulation’s novelty left no deep qualitative studies of organisational compliance experiences.Existing research had mainly reported compliance and awareness percentages or metrics such as budgets and workforce size; this study addresses the qualitative gap.Source: §2.3 · p. 3

3 METHODOLOGY

• The study seeks an in-depth account of organisational challenges, asking what direct users thought of GDPR and how compliance implementation proceeded.The broader objectives also include understanding feasibility, awareness, enforcement expectations, and compliance verification.Source: §3 · p. 3
• Interview questions were derived from the research questions, informed by prior work, and guided in part by the UK ICO’s GDPR self-assessment toolkit.The questions were designed to cover the study’s areas of interest while accommodating respondents with different backgrounds.Source: §3 · p. 3
• Semi-structured interviews used broad, intentionally non-specific opening questions and more focused follow-ups to balance consistent themes with respondents’ priorities.Questions were designed to be neutral, and examples were available for topics expected to be esoteric or non-specific.Source: §3 · p. 3
• Participants were recruited through professional contacts and snowball sampling, and interviews took place in person, by phone, or through internet voice chat.Ethics clearance was obtained, and participants gave documented consent before interviews and recording.Source: §3 · p. 3
• Anonymised transcripts were manually familiarised and then qualitatively coded using a hybrid frame combining research objectives with themes identified in the first stage.Transcript sections were tagged with relevant codes to support closer analysis.Source: §3 · p. 3

4 RESULTS AND ANALYSIS

• All but one respondent had considerable direct experience implementing GDPR, and those with direct experience considered compliance arduous but worthwhile.The respondents came from varied backgrounds and work areas.Source: §4 · p. 3

Translating GDPR into a Technical Context

• Large organisations and security-focused SMEs found GDPR more feasible to implement, while other SMEs struggled to decipher expectations and could expend considerable effort on basic compliance.For the less prepared SMEs, these hurdles could prevent them from engaging with the regulation’s broader philosophies.Source: Translating GDPR into a Technical… · pp. 3–4
• GDPR’s qualitative provisions created uncertainty for some SMEs, while larger or more confident organisations viewed them as flexibility for risk management and reassessing cyber-risk.Respondents also agreed that GDPR was a step toward more thoughtful cybersecurity practices, with data-protection impact assessments playing a vital role in reassessment.Source: Translating GDPR into a Technical… · p. 4

Readability and ease of understanding

• Respondents distinguished the document’s readable wording from its volume and the effort needed to interpret terms such as “appropriate” in light of organisational risk.One respondent described the text as easy to read but noted that there was a lot of it; another said “appropriate” required considering the organisation’s risk.Source: Readability and ease of understanding · p. 4
• Respondents who worked directly with GDPR generally found it readable, but understanding its meaning and applying it could be challenging without legal expertise.Technically focused respondents said an average engineer would struggle to use the regulation directly without legal support.Source: Readability and ease of understanding · p. 4

• Respondents described GDPR’s size as daunting, with limited-capacity organisations potentially defaulting to inaction.Source: Awareness · p. 4
• All participating companies were aware of GDPR and began compliance processes before the deadline.Source: Awareness · p. 4
• Awareness varied by security focus, and less security-focused organisations initially drove compliance largely through their own efforts.Source: Awareness · p. 4
• Some SMEs/SMBs could not make substantive compliance progress because of strained resources and ICO guidance arriving close to the deadline.Source: Awareness · pp. 4–5

• Organisations expected lawyers to negotiate how GDPR relates to other legislation, which respondents said could exclude one another.Source: Expectations of Judicial Response · p. 5
• All respondents expected constructive GDPR enforcement and said courts would need to act pragmatically and reasonably.Source: Expectations of Judicial Response · p. 5
• Respondents said the meaning of appropriate practice would become clearer only after the first GDPR cases, and feared the ICO might judge their efforts differently.Source: Expectations of Judicial Response · p. 5
• Smaller UK organisations relied heavily on ICO guidance, but its belated release caused concern despite the regulator’s stated desire for sensible enforcement.Source: Expectations of Judicial Response · p. 5

• Respondents said GDPR’s technical abilities were not far beyond earlier data-protection standards, focusing instead on mapping, monitoring, protocol updates and training.Source: Mechanisms, Techniques and Processes · p. 5
• Data-flow mapping was foundational to understanding where data moved and was stored, but complex networks made it especially burdensome for many SMEs/SMBs.Successful mapping helped uncover previously unseen risky practices.Source: Mechanisms, Techniques and Processes · p. 5
• Automation supported monitoring, tagging and warnings, but respondents considered it insufficiently trusted and effective for more than rudimentary data-protection decisions.Source: Mechanisms, Techniques and Processes · p. 5
• Organisations used training and education, while SMEs/SMBs generally opted for shorter seminars and workshops rather than large-scale retraining.Source: Mechanisms, Techniques and Processes · p. 5
• Because data systems are complex and unique, respondents saw no simple way to address compliance challenges; one suggested SMEs might use larger firms’ services instead.Source: Mechanisms, Techniques and Processes · p. 5

• Confident large companies and data-protection forerunners generally did not rely on state support, and one respondent questioned whether the ICO could handle its expected workload.Source: Support from government, industry and… · p. 6
• Smaller organisations made liberal use of ICO guidance, which respondents said could be effective and timely in answering queries, but its lateness remained a major concern.Source: Support from government, industry and… · p. 6
• Respondents reported predatory legal and technology offers, a hazard especially for SMEs/SMBs, while no participant successfully cooperated with legal professionals.Source: Support from government, industry and… · p. 6
• No organisation used academic research in compliance; respondents found it insufficiently pragmatic or transparent for immediate application, or lacked time to consult it.Source: Support from government, industry and… · p. 6

Compliance and Verification

• One respondent said GDPR revealed data-processing practices that had previously gone unnoticed, which the organisation was then addressing.Source: Compliance and Verification · p. 6
• Large organisations and security-focused SMEs were generally confident in their compliance, while other SMEs were less certain and more concerned about compliance’s “fuzziness.”Some organisations said they met minimum standards but had higher long-term aspirations.Source: Compliance and Verification · pp. 6–7
• Clear records and audit trails were seen by compliance leads as improving data protection, although the study could not establish whether record keeping was equally strong across organisations.Source: Compliance and Verification · p. 7
• Qualitative GDPR statements offered flexibility to some, but their ambiguity could outweigh that benefit for less data-protection-focused SMEs struggling to translate them into practice.Source: Compliance and Verification · p. 7
• One respondent believed companies might treat compliance as box-ticking and limit data-protection maturity to what reduces potential financial losses, depending on judicial penalties.Source: Compliance and Verification · p. 7
• Some smaller organisations had to prioritise compliance areas because of severely restricted budgets and resources, leaving willing firms ill-equipped to comply substantially in the short term.Source: Compliance and Verification · p. 7

5 CONCLUSION

• Organisations generally found compliance doable, but less data-protection-focused SMEs struggled unless already focused on security, and some could not comply within the available time.The main challenges included interpreting qualitative expectations, mapping data flows, and verifying compliance without preceding case law.Source: §5 · p. 7
• Compliance confidence often rested on an assumption of pragmatic assessment, leaving courts to determine whether GDPR would be beneficial or stifling.Source: §5 · p. 7
• Existing software engineering paradigms appeared capable of handling GDPR, but feasibility within short timescales was not guaranteed and technical feedback was limited.The paper suggests large firms with strong data-protection capabilities might become data-service providers to SMEs.Source: §5 · p. 7
• GDPR’s interpretive flexibility encouraged organisations to inspect their data-protection stance, but could burden smaller firms lacking resources to manage the overhead.Source: §5 · p. 7
• Government support was particularly effective in helping organisations contextualise qualitative requirements, while industry could contribute training or bespoke services to help resource-constrained smaller organisations.Source: §5 · p. 7

6 LIMITATIONS AND FURTHER WORK

• The authors describe this as an early study and propose longer research with more participants to reduce existing research risks.Source: §6 · p. 8
• Recruitment may have favoured organisations with more positive compliance perceptions, while many interviewees came from the authors’ professional and academic circles, potentially skewing the sample toward greater security maturity.The authors note that organisations uneasy about compliance might avoid discussing it for fear of repercussions or reputational damage.Source: §6 · p. 8
• Respondents’ varied knowledge, especially of technical compliance, reduced the pool of technical responses; a developer-focused study could investigate engineering issues more directly.Source: §6 · p. 8
• Further work could focus on technical issues or industry support, and structured interviews could enable quantitative comparisons such as the cost-effectiveness of different compliance investments.Source: §6 · p. 8