Six Years of GDPR: Companies Remain Critical
Research
22.05.2024
ZEW Surveys 1,350 Companies on the General Data Protection Regulation
Even nearly six years after its enactment, the General Data Protection Regulation (GDPR), which aims to harmonise rules on the use of personal data across the EU, is still largely viewed critically by many companies. This is the result of a representative survey of about 1,350 businesses in Germany, conducted by ZEW Mannheim in March 2024.
“Approximately one in two companies in the information economy and manufacturing industry weigh the negative aspects of the GDPR more heavily than the potential positive aspects. Accordingly, there are only a few companies that have a positive view of the GDPR. Merely seven per cent in the information economy and two per cent in the manufacturing industry see the positive aspects of the regulation as outweighing the negative ones,” comments Dr. Daniel Erdsiek, a researcher in ZEW’s “Digital Economy” Unit, on the results.
GDPR complicates processes
In almost 60 per cent of companies in the information economy, business processes have become more complicated as a result of the GDPR. In order to comply with the new rules, it was sometimes necessary to take comprehensive changes in information obligations as well as users’ rights into account, which included the implementation of concepts such as privacy by design and privacy by default. Consequently, GDPR implementation has resulted in heavy workloads for 63 per cent of companies. In addition, the current effort to comply with the GDPR is considered to be high by the majority of companies. Furthermore, over half of the companies report additional costs for employee training and increased demand for external consulting.
GDPR hinders AI adoption
According to some companies, the GDPR has also had negative effects on their business activities. One in four companies in the information economy say that the GDPR has slowed down innovation, with this figure rising to 38 per cent for large companies with at least 100 employees. “Moreover, from the companies’ perspective, the new regulations can also pose a barrier to the adoption of new technologies, especially those relying on high-quality and large datasets, as is the case with artificial intelligence. Eighteen per cent of companies report that GDPR has made it difficult or impossible to adopt new technologies such as AI. Among large companies in the information economy, as many as 30 per cent see it as an obstacle to the implementation of new technologies,” Erdsiek explains. Possibly as a result of such constraints, almost one in ten companies associate the GDPR with a threat to their business activities.
“We asked companies in the information economy about their assessment of the new regulations in December 2017 and March 2020. Based on these earlier results, we can see that companies’ critical view of GDPR has hardly changed over time. Rather, the negative aspects of the regulation have occurred somewhat more frequently than companies expected in December 2017, shortly before the GDPR came into force,” summarises Erdsiek.
Some positive effects of the GDPR
It was not all negative, though; companies also reported positive effects. For example, 41 per cent of companies say they have reviewed and optimised their processes, with 28 per cent of companies standardising data processing procedures as a result. For a quarter of companies, the GDPR has led to increased legal certainty – a gain of six percentage points compared to March 2020. The proportion of companies expecting a rise in customer trust as a result of the GDPR has also grown (from twelve to twenty per cent). However, the view that the GDPR has had a positive impact on the business development of their own company (six per cent) or has led to a competitive advantage for EU companies in international markets (six per cent) is less common.
About the study
In March 2024, approximately 1,350 companies from the manufacturing industry and the information economy, consisting of the ICT sector, media service providers, and knowledge-intensive service providers, participated in the ZEW survey.
