Europe’s complex network of overlapping regulations is hitting startup founders hard and holding back business, according to a new research by startup support organization DutchBasecamp.

Some 79% of tech founders claim they've been hit by regulatory friction over the last year, according to the The Realities of Scaling in Europe report, which was launched in partnership with the Computer & Communications Industry Association (CCIA).

More than half (58%) said they'd delayed entering another EU market, 45% have paused or canceled features, and 44% have experienced delayed or lost deals.

As negotiations on the Digital Omnibus continue, the CCIA warned that many meaningful simplification measures could fall by the wayside, which has the potential to further compound challenges faced by startups.

Some member states are resisting a proposal allowing businesses to report a cybersecurity incident once, rather than separately under seven overlapping frameworks.

Meanwhile, a fix that would establish legitimate interest as a legal basis for responsible AI training has been stripped out.

While postponing certain deadlines has provided some breathing room, many simplifications have been rejected, leaving developers with limited implementation time while essential codes, guidance, and standards are still missing.

“We warned from the start that the Commission’s proposals to simplify the patchwork of EU tech and digital rules were only the bare minimum. Instead of going further, Parliament and Council are now weakening, rejecting, or delaying even the most basic fixes," said Daniel Friedlaender, senior vice president and head of CCIA Europe.

“Europe’s innovators have shown remarkable patience in navigating today’s regulatory maze, but that patience is running out. EU institutions and member states need to wake up: 2026 must bring real improvements for tech companies. Europe knows the problems. If we refuse to fix them, we can’t be surprised if our founders look outside the EU for success.”

Growing regulatory friction

Nearly a quarter of survey respondents said they'd spent more than 30% of their budgets on compliance costs, while 24% are considering or have already relocated their headquarters due to regulation.

In January, the European Investment Bank, with the European Commission, found that roughly one-in-ten EU scale-ups have relocated abroad, with around 85% of those moving to the United States.

The Commission’s Joint Research Center put the headquarters-relocation rate for venture-backed startups at between 3.3% and 4.3%, ten times the rate for comparable non-VC-backed firms.

More than half of founders said they'd steered clear of an EU country because of regulatory concerns, and only 21% said they'd seen no material impact from EU or national rules.

"Europe is already losing tech founders, products, and growth," said Masha Moisseyeva, managing director of DutchBasecamp.

"When 45% of those surveyed have paused or cancelled features, 58% have delayed entering another EU market, and 44% have lost or delayed deals in a single year, the urgent need for regulatory simplification is no longer a theoretical debate about EU competitiveness. The damage is happening now.”

Regulatory confusion is rife

Much of the cost, the researchers found, comes not from compliance itself but from not knowing what compliance will require.

Indeed, founders often cite uncertainty surrounding future EU AI Act obligations before any requirement has formally bound them.

“Founders are not asking the EU to lower its standards. They are asking for clear, workable rules they can rely on across the Single Market," said Moisseyeva.

"Instead, uncertainty and overlapping obligations are dictating what they build, who they serve, and how fast they grow.”

FOLLOW US ON SOCIAL MEDIA

Kyndryl has announced a new “policy as code” feature aimed at helping organizations scale agentic AI across complex and regulated environments.

The idea is to turn a company's organizational rules, regulatory requirements, and operational controls into machine‑readable policies that govern where agents can and can’t operate.

"Organizations typically implement policy as code through a combination of declarative policy languages and enforcement engines," explained Patrick Gormley, Kyndryl's global data science and AI consult lead.

"In other words, they incorporate the appropriate regulations and operational rules into code that AI agents can read and must obey. If it’s in the code, the AI agent must execute. And if an instruction is not in the code, the AI agent cannot see or act upon it."

The move comes amid growing regulatory compliance concerns for enterprises ramping up agentic AI adoption. According to Kyndryl, more than three-in-ten of its customers have complained that compliance issues are seriously limiting their ability to scale recent technology investments.

The new policy as code capability aims to address this by defining operational boundaries and designing agents' actions to remain explainable, reviewable, and aligned with customer-defined business and regulatory requirements.

This new feature will be embedded directly into the Kyndryl Agentic AI Framework, launched last summer as a portfolio of specialized, self-directed, self-learning AI agents.

"Kyndryl's policy as code capability overcomes limitations of conventional AI agent controls and provides the structure customers need as they adopt agentic AI solutions," said Ismail Amla, senior vice president, Kyndryl Consult.

What to expect with Kyndryl’s ‘policy as code’

Features include deterministic execution, with agents only executing actions that have been permitted and enforced in advance.

Guardrails block unpredictable or unauthorized actions along the workflow, eliminating the operational impact of agentic hallucinations, and each agent action and decision is logged and explainable, supporting compliance and oversight.

Notably, decisions are subject to human supervision, with agents executing tasks aligned with established and testable policies that are monitored via a dashboard.

Gormley said policy as code should be particularly valuable in heavily regulated industries, such as financial services, healthcare and government.

"Policy as code helps enable these industries to realize the full benefits of AI and agentic AI by reducing the risk of the types of compliance failures that damage reputations and incur heavy financial penalties," he said.

"By enforcing programmatic rules at scale, policy as code helps eliminate the human error that can lead to granting inappropriate permissions to AI, interpreting rules and regulations inconsistently, and failing to document exceptions to standard operations."

FOLLOW US ON SOCIAL MEDIA

Europe’s long-running struggle to define digital sovereignty – and to turn it into something practical – is reaching an inflection point.

That was the message at this year’s Gaia-X Summit in Porto, where executives and governments argued that the continent finally has the technical foundations for sovereign data sharing.

All it needs now is the political will, economic models, and global partnerships to make it work at scale.

Gaia-X is a Brussels-based industry association bringing together European enterprises, technology vendors, cloud providers, standards bodies, and public sector institutions.

Its purpose is to build a common, verifiable framework: the Gaia-X Trust Framework. This framework is designed to define how organizations can share, store, and govern data in interoperable, sovereign, and audit-ready ways.

The initiative now underpins dozens of projects in manufacturing, energy, aerospace, mobility, finance and healthcare.

Unlike early misconceptions, Gaia-X is not a cloud provider. It sets rules around identity, compliance automation, service labelling, policy enforcement, and interoperability that cloud and data ecosystem providers must adhere to if they want to be considered sovereign-ready.

From pilots to real deployments

Gaia-X CEO Ulrich Ahle opened the Summit by admitting that while conceptual momentum is strong, adoption remains thin on the ground.

Europe has “more than 150 implementation projects in Europe at the moment in preparation,” but “we still have just a handful of operational databases really implementing benefits for their end users,” he said.

To help change that, Gaia-X will release its first multi-provider catalogue: 600 services from 15 providers aligned to four security and sovereignty levels. Ahle also reiterated Gaia-X’s near-term growth target: 1,000 services by the end of the year, scaling to 3,000 afterwards.

The top tier of the catalogue – Gaia-X Label Level 3 – is designed for maximum sensitivity use cases such as aerospace, energy, and national infrastructure workloads. Critically, Level 3 services can only be delivered by providers that have their headquarters in Europe, ensuring they are not subject to extraterritorial laws like the US Cloud Act.

EDF’s nuclear station program illustrates the demand: its data space is “requesting the highest level of security… the Gaia-X label level three. And this highest level security is reality,” said Ahle.

It’s worth noting that the conversation around digital sovereignty in Europe has shifted dramatically in the last two years, driven by one factor: AI systems that ingest sensitive, large-scale operational data.

“Trustful AI needs trustful data. And here, data sovereignty is of utmost importance,” said Ahle.

Hyperscalers: foundational but insufficient

CIOs and CTOs know the hyperscalers aren’t going anywhere. Gaia-X leaders know it too. But the limits of “sovereign cloud” offerings from US players were addressed without ambiguity.

Even when operated inside Europe by European employees, those services “are still under the American legislation, under the Cloud Act,” said Ahle. That constraint may be acceptable for 90% of enterprise workloads, but not for the 10% that carry regulatory, national infrastructure, or safety-critical risks.

Chairwoman of the Gaia-X Board and EVP digital at Airbus, Catherine Jestin, put it more bluntly: “The fact you have not done it in the past doesn’t guarantee that you will do it in the future.”

This is why Airbus does use hyperscaler services – but not for its most sensitive workloads: “I really love to work with AWS, with Google and Microsoft… but not for the most critical applications and services.”

For IT teams, this is the emerging pattern: hyperscalers for scale, elasticity and tooling; sovereign frameworks for critical data integrity, compliance automation, and legal insulation.

When asked whether trust in US providers had worsened under President Donald Trump’s second term in office, Jestin noted, “It hasn’t helped.”

This aligns with the wider shift across Europe. For years, EU member states could not agree on whether stringent sovereignty rules were needed. But now, Jestin said, “we see with the latest publication from the European Commission that’s now… on the top of the agenda.”

CIOs designing long-term cloud strategies could see certifications, service labels, and jurisdictional guarantees increasingly required by regulators and embedded into RFPs.

Operating a data space is not free

One of the most useful insights for IT leaders came from Jestin, who highlighted the hidden operational costs of building and maintaining data spaces – the very reason many sovereign cloud initiatives fail internally.

Running a compliant data space requires organizations to “maintain and support the connectors… to maintain [and] support Identity and Access Management (IAM)… to maintain the contracts.”

Without sustainable economics, she warned, “you just go in a negative spiral, and your data space will not be successful in the future.”

To address this, Gaia-X is working with economists at Paris Dauphine University to model participant roles, orchestrator responsibilities, and cost-recovery mechanisms to ensure sovereignty is engineered as a business model, not just a compliance posture.

The bottom line for CIOs, CTOs, and architects

Gaia-X said it’s not trying to reinvent the cloud. Rather it’s trying to standardize trust, compliance, and verifiability in a market dominated by providers whose legal obligations don’t always align with European sovereignty requirements.

The Porto Summit’s message was that sovereignty is becoming programmable through labels, identity rules, compliance automation, and clearing houses.

Yes, hyperscalers remain essential, but they are no longer sufficient for high-risk workloads. AI governance is elevating data integrity and traceability to strategic priorities.

Economic models for data spaces must be planned upfront, not retrofitted. And geopolitics has entered the IT architecture stack in a way organizations can no longer ignore.

“Technology is ready. It is about adoption… and sustainable operation,” Ahle said.

MORE FROM ITPRO

• So much for data sovereignty — AI infrastructure is dominated by just a handful of countries
• Can the UK achieve AI sovereignty?
• SAP wants to take data sovereignty to the next level with new 'on-site' infrastructure options

The push towards data sovereignty continues, with 51% of UK organizations now acknowledging it as a crucial aspect of their data management strategy.

According to a study of 500 IT decision makers in large organizations carried out by OVHcloud, more than three-quarters said they believe data sovereignty is now more important to their organization than it was three years ago.

However, their views on data sovereignty varied considerably. Four-in-ten said they saw it primarily as a compliance issue, while 36% saw it as a question of data access, handling or storage, and 28% as relating to data portability.

"Forty one percent of UK organizations told us that data sovereignty is simply something to be complied with," said Matt Tebay, multi-cloud evangelist at OVHcloud.

"However, forty two percent said that it was important to customers, and therefore an asset to them and their businesses. This shows a change in how companies have traditionally seen data sovereignty, and an evolution of how they’re approaching it more broadly."

Businesses are willing to pay the extra, with almost two thirds of organizations saying they were happy to pay between 11% and 30% more for a sovereign technology product that would meet all of their regulatory and sovereignty needs.

Only 6.5% said they weren't willing to pay more than normal for a sovereign product.

“Data sovereignty is gaining maturity, but it’s not an easy matter. Twenty-three per cent of IT decision makers told us that they viewed data sovereignty as ‘complex and full of drama’, and 27% said that they thought it was comparable to the hit TV show The Office – and if they didn’t laugh, they’d cry," said Tebay.

"Clearly, the intersection of customer trust, technology, regulation and commercial considerations can make for a challenging journey, but it’s an important one and like all journeys, the first step is the most important."

Data sovereignty is becoming a growing necessity, thanks to concerns over privacy and the potential for data to be accessed by other nation states.

While the EU has been in the lead in introducing regulations, other governments are moving to bring similar rules, including Egypt, Singapore, the United Arab Emirates (UAE), and the US.

According to Gartner, by 2027 data sovereignty will be one of the two top criteria, along with sustainability, when evaluating public cloud generative AI services.

"Digital sovereignty will drive the need to include cloud providers that can meet the evolving and unique requirements of sovereign operations no matter the region they operate in," said Sid Nag, vice president analyst at Gartner.

The multi-billion governance, risk, and compliance (GRC) market is being driven by an increasingly complex regulatory environment, including GDPR, NIS2, and the Digital Operational Resilience Act (DORA) frameworks, among others.

At the same time, the growing integration of AI and automation technologies into GRC solutions is fueling adoption, as businesses see the benefits of applying digital transformation across their GRC strategies.

As we all know, the threat landscape continues to be extremely challenging. Cybersecurity and data protection breaches are increasingly followed by compliance enforcement action as authorities look to improve standards across the board.

Take GDPR, for example, where cumulative compliance fines burst through the €5 billion (£4.18 billion) barrier this year as part of a wider regulatory ecosystem where individual penalties can run into the millions.

In addition, there’s also the potential compliance risks brought about by the integration of AI technologies into business processes. Here, issues such as data privacy, lack of transparency, and advanced tools that simply outpace existing regulatory frameworks are increasing the emphasis on compliance and whether organizations are keeping pace with their responsibilities.

Put these factors together and the results point to strong growth across the global GRC sector. Already worth more than $43 billion (£34.53 billion) this year, it is expected to accelerate significantly to surpass $111 billion (£89.13 billion) by 2032, according to industry figures. It’s not surprising that this is translating into significant and rapidly growing interest from the channel.

The road ahead 

Clearly there is demand from customers across various sectors, many of whom share a sense of urgency around compliance and want to get a robust GRC strategy in place – or at least update the technologies and processes they’re already relying on.

This translates into a significant opportunity for the channel, especially for those who are already specialists in cybersecurity. Whilst these are specific specializations in their own right, GRC and cybersecurity are clearly complementary. These firms should be well-positioned to drive GRC growth, including GRC as a service and virtual CISO offerings as these can be tailored to the specific requirements set out by NIS2, GDPR, and DORA, for example.

For resellers, MSPs and SIs there is a golden opportunity to build a service and product portfolio around that knowledge of the various essential compliance frameworks, leading them to engage in conversations with a wide range of customers on how they are preparing to step up their GRC efforts.

The availability of centralized compliance platforms will also help MSPs offer continuous monitoring and reporting services across customers’ business functions. These tools integrate data from various systems, such as cybersecurity, ITSM, or ERP tools, to provide a unified view of performance and potential vulnerabilities. At the same time, automated compliance workflows are growing in importance and, in many businesses, are already playing a major role in managing risk assessments, policies, and compliance audits.

There is also an important role for channel partners who can customize vendor solutions to meet sector-specific or regional requirements. Post-Brexit, for example, UK organizations that trade within the EU remain subject to various compliance requirements and as such, must design their processes and technology stack to address their obligations. Many of these businesses need the kind of expert guidance and experience that channel specialists are ideally placed to offer.

For instance, there has been growing demand for compliance solutions and a marked increase in the number of channel partners being onboarded. This is a trend we can expect to see accelerate further as organizations prioritize their compliance strategies, focus their investments and work more closely with service providers who can meet their needs. Ultimately, there is an opportunity for leaders in the field of AI and automation to help steer channel partners to offer a risk-aware approach to compliance by harnessing the power of AI and automation.

Looking ahead to 2025 and beyond, the regulatory landscape will become even more complex. As a result, organizations will need to ensure their compliance efforts remain continually robust, in line with authorities moving from periodic to ongoing assessment. I anticipate that we’ll see a significant growth in channel partners focusing on their compliance offerings, including those who diversify their approach to help their clients integrate compliance tools seamlessly with other existing systems, streamline workflows, and ensure audit readiness.

Cybersecurity is set to undergo significant changes in the coming years with a raft of new regulations set to come into effect in 2025.

To name just a few, the EU is introducing new cybersecurity regulations in late 2024 and 2025. The Network and Information Security Directive (NIS2) takes effect in October 2024, requiring businesses to strengthen threat management and incident reporting. Finally, the Digital Operational Resilience Act (DORA), starting January 2025, will look to enhance IT security for financial firms.

While these regulations are necessary, there's a risk of managed service providers (MSPs) treating compliance as a mere formality. Meeting minimum requirements is easy, but MSPs should avoid this approach. Instead, they need to ensure compliance adds real value to their security posture and that of their clients.

To avoid reducing compliance to a ‘tick-box’ exercise, MSPs must go beyond basic requirements to enhance security for themselves and clients.

Safeguarding national systems

Globally, industries face escalating threats as hackers target critical infrastructure such as water, healthcare, and banking systems. Hackers today are finding new ways to target vital systems, with potentially devastating consequences.

A recent assessment in the US has shown that 9% of public drinking water systems have critical or high cybersecurity vulnerabilities. This type of risk exposure leaves communities vulnerable to the loss of clean water, jeopardizing public health.

Other examples include cyber attacks on Transport for London (TfL) and Network Rail in the UK, and a breach of the Australian government’s systems in January, where Russian hackers stole 2.5 million documents.

The vulnerability of critical infrastructure has led to stricter legislation, driving MSPs to support vendors in fortifying their security posture. This demands a strategic approach, emphasizing proactive measures to counter modern threats like sub-zero-day exploits – rare vulnerabilities that allow attackers to take control of key systems.

Disruptions to critical infrastructure pose severe risks to national security and limit access to essential services like electricity, food, and water. With stakes this high, MSPs must move beyond basic compliance and focus on delivering IT solutions that enhance security and resilience. By prioritizing early detection and prevention, MSPs can help vendors build systems that withstand evolving cyber threats.

Investments in well-maintained infrastructure and cutting-edge technologies like quantum computing, AI, and advanced cybersecurity are no longer just about economic competitiveness – they are essential for your cyber defenses and resilience. Adequate resources must be allocated to address these growing risks and our reliance on modern connectivity.

Strategies for resilient digital hygiene

Taking a proactive approach to cybersecurity means prioritizing the protection and continuous monitoring of critical data rather than simply meeting the minimum requirements for compliance. A key starting point for achieving this is maintaining rigorous digital hygiene, which involves using systems as they are intended, continuously monitoring for irregularities, and gathering forensic data to aid in understanding and mitigating potential threats.

Advanced solutions can enhance this approach by providing comprehensive threat detection and incident response (TDIR) capabilities. These systems allow organizations to focus on early detection, enabling faster response times and minimizing the impact of breaches. By aggregating and analyzing log data from across their infrastructure, businesses can uncover hidden threats, track suspicious activities, and quickly respond to incidents.

As cyber threats become increasingly convoluted, leveraging technologies that provide real-time monitoring, threat visualization, and automated alerts becomes vital. These tools empower organisations to adapt to evolving attack methods, identify vulnerabilities before they’re exploited, and build resilience against future threats. A proactive cyber defense strategy not only mitigates risk but also ensures that businesses remain agile and secure as digitalization expands and evolves.

Strengthening global partnerships for critical security

The NIS2 directive, by expanding cybersecurity requirements across industries globally, creates an opportunity to foster stronger collaboration between intelligence agencies and law enforcement. Central to this effort is the global exchange of information across industries. For example, water companies worldwide should share insights into cyber incidents and remediation strategies, rather than restricting such collaboration to regional boundaries. This type of global knowledge-sharing can strengthen collective defenses and build more resilient infrastructure across borders.

MSPs are uniquely positioned to facilitate this global collaboration. By offering secure and cost-effective communication channels, MSPs enable industries to share critical intelligence safely. Their ability to provide around-the-clock support ensures greater transparency of IT systems, while centralized management through a single provider enhances visibility for teams accessing sensitive data from various locations.This improved oversight enhances threat detection and monitoring capabilities, reducing overall risk.

Moreover, MSP-facilitated collaboration assists in streamlining compliance efforts by standardizing IT processes across global teams. This not only simplifies adherence to regulatory requirements but also fosters a unified approach to managing cyber risks as they continue to develop.

With the emergence of new cybersecurity regulations and increasing parameters around digital activity, businesses must consider how they implement these guidelines.

MSPs should prioritize integrating regulatory frameworks into their security strategies to strengthen their defence capabilities. By moving beyond mere compliance and actively addressing emerging threats, MSPs can ensure these regulations are not just met but leveraged to enhance overall cybersecurity. This proactive approach will help regulatory initiatives achieve their intended impact while delivering meaningful, long-term value.

Set to come into effect on 17 October 2024, the Network and Information Systems Directive (NIS2) is the European Union’s latest cybersecurity legislation aimed at enhancing security capabilities across the union and creating a more cohesive, aligned approach to mitigating emerging threats.

The legislation has been long in the making, and while organizations have had ample time to prepare, some have encountered difficulties in ensuring they are compliant. 

Research from SailPoint in October 2023 found that a majority of UK firms were yet to introduce changes to adhere to key requirements outlined in the legislation. 

The study, which was based on a survey of 1,500 IT decision-makers in the UK, Germany, and France, noted that a concerning number hadn’t even begun preparations. 

Around 80% of respondents said they were still to properly assess and secure supply chains, while over three-quarters (76%) were yet to assess the efficiency of existing cybersecurity practices. 

Three-quarters of organizations had also neglected to add new risk management processes (74%) while a similar number (72%) revealed they had made no efforts to bolster cybersecurity training for staff.

Speaking at the time, Stephen Bradford, senior vice president for EMEA at SailPoint, warned that the sluggish efforts from organizations raised parallels with GDPR. 

“The threat landscape has been growing in volume and sophistication over recent years meaning the stakes have never been higher. Operational downtime, reputational damage, customer loss, and system restoration that follow any breach can cause a real headache for businesses,” he said.

“Organizations must learn from GDPR and use the next twelve months wisely to make sure cyber resilience is at the core of their business models.”

What is NIS2?

The directive is an updated version of the previous Network and Information Systems Directive (NIS) introduced by EU lawmakers in 2016, with new rules and requirements to enable organizations to contend with emerging security threats. 

As part of this sweeping update, NIS2 will expand the number of protected critical sectors to 15 compared to its previous iteration, which saw just seven sectors identified as critical. 

A key factor in this expansion lies in the potential material impact of a cyber attack on broader society if an organization in one of these industries was compromised. 

Under NIS2, organizations will be graded as ‘essential’ or ‘important’ entities depending on the area they operate in. 

Essential entities include: 

• Energy providers
• Transport companies
• Banking and financial institutions
• Healthcare organizations
• Pharmaceutical manufacturers
• Water companies
• Public services
• Digital infrastructure organizations
• ICT services

Meanwhile, ‘important entities’ include:

• Postal and courier services
• Waste management firms
• Chemical manufacturers
• Food production and processing companies
• Electronics, machinery, and vehicle manufacturers
• Online marketplaces
• Higher education and research institutions

With this in mind, NIS2 not only expands the scope of the legislation to a broader array of industries, but also means stricter requirements for organizations, placing greater emphasis on proactive cybersecurity capabilities and operational resilience, as well as tightened supply chain security.

Under the legislation, organizations will be required to adhere to strict risk assessment and management rules, as well as new rules on incident reporting. 

The latter of these is a particular key focus of the new legislation. Unlike its predecessor, NIS2 will require that every cybersecurity incident be reported regardless of whether it affected operations. 

The goal of this is to help EU-based security authorities improve broader monitoring and response capabilities and create an aligned approach to cybersecurity across the union. As part of this approach, every EU member state will designate a Computer Security Incident Response Team (CSIRT) for incident reporting. 

Reporting requirements in the event of an incident come in three key stages, starting with an initial disclosure - or ‘early warning’ - within 24 hours. 

A second, more detailed report must be submitted within 72 hours containing an assessment of the incident, including its potential severity, impact, and indicators of compromise. A third, final, and comprehensive report must then be submitted within one month under the legislation. 

Harsher penalties for those found in breach of the directive will also come into effect, raising the stakes for non-compliant organizations. Fines can reach up to €10 million for non-compliant organizations or 2% of global annual revenue, or whichever is higher. 

Notably, under Article 31 of the legislation, senior management figures can be held accountable in the event of a breach that authorities deem to have been due to a lack of oversight or appropriate safeguards. 

According to EU lawmakers, the addition of liabilities for senior management is aimed at emphasizing the importance of the legislation while relieving the burden placed on IT teams. 

“In an attempt to lower the pressure put on IT departments to single-handedly ensure the security of the organization and to change the sentiment of whose responsibility cybersecurity is, NIS2 includes new measures to hold top management personally liable and responsible for gross negligence in the event of a security incident,” according to official NIS2 learning materials.. 

“Specifically, NIS2 allows Member State authorities to hold organization managers personally liable if gross negligence is proven after a cyber incident.”

This raises the stakes for the C-suite and security leaders and means senior management must take steps to ensure compliance. But what steps can organizations take to comply?

How can organizations prepare for NIS2?

First and foremost, it’s critical for organizations to realize that NIS2 does not apply specifically to European entities, but also to any that operate within the union, even if they are headquartered outside the EU.  This widens the scope of the legislation significantly and underlines the wider implications of the new rules for enterprises. 

Organizations that fall under the scope of the regulation can start by assessing their risk profile to establish any potential weak points within their internal cybersecurity processes. 

Risk assessments can be carried out by in-house staff. However, in some circumstances, organizations may not have the capabilities or financial resources to conduct such an extensive audit. In these scenarios, employing the services of a third-party provider to conduct this on your behalf could be an option. 

Audits of external risk are also advised given the strong emphasis NIS2 places on supply chain security. According to research from Gartner, almost half (45%) of organizations are expected to have experienced a software supply chain attack by 2025. 

With NIS2 set to be in effect by then, organizations must ensure they assess any risks posed by managed services providers and third-party vendors.

In preparation for NIS2, organizations must also assess how they intend to ensure business continuity in the event of a serious cybersecurity incident. Best practice tips from the EU include formulating plans on emergency procedures and system recovery in the event of an incident. 

Digital transformation creates a variety of new opportunities, but unfortunately can also result in the increase of risks, and the more an enterprise can understand the risks it faces - especially as a company-wide initiative - the more successful their digitisation will be.

This special edition guide can help your employees better understand how they can be part of a successful digital risk management strategy, with practical advice on how to apply learnings to real risk management situations.

Download now to learn:

• The basics of risk identification and management
• How to manage digital risk
• As well as five tips for successful digital transformation

Provided by

The biggest threat to food and beverage profitability is having a total recall, and in the last decade there’s been a significant increase in food product alerts as food safety becomes a greater concern for all manufacturers and regulations are increased.

This whitepaper shares the importance of traceability of product sources through supply chains, and highlights the technologies that are improving data insights at its core.

Download this paper now to learn how to achieve traceability as a key objective in three ways.

Provided by

Bioengineered food is food that contains genetically modified material, and soon food manufacturers will be required to inform customers if their products contain any, through labels and display signage.

The National Bioengineered Food Disclosure Standard (NBFDS) is a mandatory requirement as of the beginning of 2022, and this whitepaper shares the key points of NBFDS for food manufacturers and its impact, as well as the technologies that can support the industry to be NBFDS compliant.

Download this paper now to learn the solutions manufacturers, ingredient suppliers and retailers can implement now.

Provided by

For many organisations, an approach to data security means some combination of the following: data loss prevention, access control, and encryption. Then, it’s a checklist of additional requirements that they must meet to be in compliance, meet contractual obligations, or remedy a failed audit. It’s time to take a strategic — and data-centric — approach.

This Forrester report shares how to build core capabilities for data protection that are shared across security best practices, standards, and compliance requirements.

Download now to learn how to take a strategic approach to protecting your data and data privacy.

Provided by

A bipartisan US antitrust bill, which could soon be voted on in the Senate, has reportedly faced an expensive opposition campaign by tech giants.

One of several bills included in a wider antitrust proposal, the American Innovation and Choice Online Act (AICO) has been two years in the making and seeks to forbid tech giants from engaging in ‘self preferencing’, using platform data for unfair profitable advantage, and infringing upon the payment or pricing methodology of competitors.

Bloomberg reports that Google, Apple, Amazon and Meta, alongside trade groups with which they are affiliated, have spent just under $95 million since 2021 to lobby against support for the bill, which they argue will limit their ability to run platforms effectively.

In a similar focus to the EU’s Digital Markets Act (DMA), the AICO would seek to prevent so-called ‘gatekeeper’ firms, those that run the largest online platforms home to many smaller competitors, from abusing their positions of power for financial gain. For example, Google’s promotion of Google Maps reviews when a customer searches for a restaurant or Amazon’s control over which products are listed highest will be put under scrutiny by the bill.

“It is really hard to take on these subjects when you have the biggest companies the world has ever known, that control an inordinate part of the economy, opposed to it,” Vox quotes senator Amy Klobuchar, the co-sponsor of the AICO, as having remarked.

In a blog post from January, Google’s president of global affairs Kent Walker argued that potential US legislation on this level would be damaging for customers and the tech sector:

“Antitrust law is about ensuring that companies are competing hard to build their best products for consumers.

“But the vague and sweeping provisions of these bills would break popular products that help consumers and small businesses, only to benefit a handful of companies who brought their pleas to Washington.”

Those sponsoring the bill are confident that if voted on, it has the support necessary to clear the Senate. But it remains to be seen if the bill will be raised for a vote in the narrow window before the midterm elections in November, which are likely to change the voting balance within the senate.

If enacted, the AICO would give the Federal Trade Commission (FTC), along with the Department of Justice, the authority to sue companies that fail to comply, though what the penalty could look like has yet to be determined.

The bill comes to vote as many legislators around the world consider the power that many tech giants exert over their market. The EU has recently opened an investigation into Google’s dominance over the Play Store, which sees it charging high developer fees and limiting the extent to which apps can use alternative billing systems, while in the UK, the Competition and Markets Authority (CMA) has opened an investigation into whether Amazon’s platform gives its retail arm an unfair advantage over third-party sellers.

Despite individual reviews of monopolistic practice, however, the UK is not yet pursuing big tech regulation to the same degree as the EU is with the DMA. Set to come into effect in Spring 2023, this will greatly curb the extent to which tech giants can use platforms to unfairly push their services, as well as protect data from being used to damage the competitiveness of the market.

In particular, the act seeks to limit the powers of gatekeeper companies. Such firms that fail to comply with the rules will face fines of up to 10% of their worldwide turnover, or 20% on repeat offences.

Without lobbying power in Europe as in the US, there is little that Google or any other tech giant can do to halt the implementation of the DMA, and companies may be forced to change their worldwide practice as a result.

Cyber security provider Proofpoint has released a new Intelligent Compliance Platform designed to provide enterprises with modern regulatory safeguards while simplifying corporate legal protection devices.

Leveraging the company’s machine learning engine, the offering serves up AI-powered collection, classification, detection, prevention, search, eDiscovery, supervision, as well as next-gen predictive analytics – all while meeting complex compliance and information governance obligations.

The platform can classify and predict risks across a range of digital communications channels, files, email, and endpoint activities.

Proofpoint says this enables teams within compliance, IT, information management, and legal to gain visibility and access information with superior fidelity, as well as preventing risks in real time.

“We understand today’s organisations are overwhelmed with growing volumes of data that are incredibly difficult to manage,” explained Kevin Leusing, senior vice president and general manager of Compliance at Proofpoint.

“For Compliance and Legal staff, that means having to manually search and review petabytes of messages or files from regulatory compliance, supervisory, or investigation review queues.”

Instead, Proofpoint’s new Intelligent Compliance Platform pulls from several of the firm’s solutions to tackle the issue, including Capture, Patrol, Track, Archive, Discover, Supervision, and Automate.

Existing customers can leverage the platform in two different ways. Those looking for efficiency can reduce supervised communications content review time by up to 84%, the company says.

For teams more focused on effectiveness, sentiment analysis of communications data and a variety of machine learning models enable early detection of organisational behavioural misconduct.

Either way, Proofpoint says customers can easily manage communication content from platforms such as Microsoft Teams, Zoom, Meta, and Slack, thanks to its unified data collection and preservation.

Customers can also automate risk detection in real time communications, reduce time spent on data review by bypassing pre-flagged content, as well as leverage AI-powered data discovery with case management.

“The new Intelligent Compliance Platform vastly improves the detection of non-compliant communications and content while quickly pinpointing supervised insider risks,” Leusing added.

The UK’s Competition and Markets Authority (CMA) has opened a new investigation into Amazon for allegedly misusing seller data to unfairly advantage its business, as well as other potentially anti-competitive practices.

There are three main focuses for the CMA’s investigation, the first of which will examine how the company collects and uses third-party data for sellers on the Amazon e-commerce platform, “including whether this gives Amazon an unfair advantage in relation to business decisions made by its retail arm”.

The CMA will also be scrutinising how the company chooses which product is added to the ‘Buy Box’ - a more convenient listing for sellers that offers one-click purchasing, and how it sets the eligibility criteria for selling under its Prime brand.

Amazon is facing allegations of anti-competitive behaviour that “could result in a worse deal for consumers”, the CMA said.

The case follows a separate active investigation into the company for similar reasons by the European Commission (EC) but will focus entirely on the UK side of Amazon’s business. The EC’s investigation will not look at practices in the UK now the nation has left the European Union (EU).

The EC formally charged Amazon for the misuse of third-party seller data in 2020 after it was found to have used that data to make informed strategic decisions to compete against them.

Amazon was also accused in 2020 of misleading Congress about using third-party seller data after a similar probe was launched in the US.

Amazon’s e-commerce platform is populated by third-party sellers that benefit from the wide pool of consumers that use Amazon.co.uk daily, as well as additional benefits such as matching sellers with consumers and the potential to have orders ‘fulfilled by Amazon’ where storage and shipping are handled by Amazon.

Amazon also has its own retail business that it runs off its e-commerce platform and the CMA will be scrutinising whether the platform is affording special treatment to Amazon’s retail business, giving it an unfairly advantageous position over third-party sellers.

“Millions of people across the UK rely on Amazon’s services for fast delivery of all types of products at the click of a button,” said Sarah Cardell, general counsel at the CMA.

“This is an important area so it’s right that we carefully investigate whether Amazon is using third-party data to give an unfair boost to its own retail business and whether it favours sellers who use its logistics and delivery services – both of which could weaken competition.”

The CMA said “thousands” of British businesses use Amazon to sell their products and consumers could end up paying more for lower-quality items if Amazon is unfairly abusing its position as the platform’s controller to benefit its own business.

Amazon and Google are also under CMA investigation for failing to tackle rampant fake reviews on their websites, though it is still ongoing with no conclusions drawn yet.

The investigation is launched a day after the EU's landmark vote in favour of passing the Digital Markets Act (DMA) which aims to prevent big tech companies like Amazon from abusing their 'gatekeeper' positions.

Approved by an overwhelming majority, the DMA will compel large companies to give greater data rights to third parties and in Amazon's case, the sellers on its platform.

Third parties will now be allowed to access the data they generate to help them promote their own products and make better business decisions.

The EU hopes the new legislation will help prevent big tech companies from engaging in anti-competitive practices, but implementation will take time.

Datadog has launched a new service to help organizations aggregate, filter, and route ‌large volumes‌ ‌of observability data.

Dubbed Observability Pipelines, the vendor-agnostic tool offers customers with a unified view of infrastructure and application metrics, logs, and traces.

The granular outlook helps with lowering costs, reducing technology lock-in, standardizing data quality, improving compliance, and scaling observability practices, according to Datadog.

Most notably, businesses can gather, enrich, transform, sanitize, and route observability data from any source to any destination at petabyte scale. Rule-based throttles and reactive routing strategies ‌can also be deployed to protect against data spikes.

If need be, organizations can also choose to redact sensitive data from a data stream ‌before‌ ‌it‌ ‌leaves‌ ‌the company‌ ‌network.

"As the amount of telemetry continues to grow at an organization, teams are often completely overwhelmed—if they're not blind to—the runaway costs, reliability and compliance risks that come from a lack of visibility into infrastructure and application data," said Zach Sherman, senior product manager at Datadog.

“We built Datadog Observability Pipelines to give organizations a powerful way to take back control of their data, without compromising visibility for engineering, security and SRE teams," added Sherman.

Datadog’s Observability Pipelines also comes with an extensive list of integrations or built-in connectors that give organizations the ability to collect and route data quickly and easily to any existing tools.

Auditing is an independent consulting activity, intended to help organisations improve their operations, as it evaluates ways to improve risk management. However within the technology industry, auditors are being replaced by automation, and with CFOs looking to reduce spending, the function of audit and compliance could become obsolete.

The audit process needs to change for the better, and with emerging technology, there’s great potential for auditing to adapt and drive real value in relation to data analytics and risk management monitoring.

Download this whitepaper to learn where audit technology is headed, and what it means for your organisation.

Provided by

In today’s hybrid working world, with the increased number of devices, data and systems, the risk to global IT is significant, making the regulatory environment more complex.

With IT leaders facing more challenges than ever before, the differing regulations and compliance frameworks means a vast amount of work for an often resource-limited team. But being able to get to a stage of IT compliance, ready for audit, is achievable with the right technology.

Download this whitepaper to understand the key components when it comes to being IT audit-ready - including process, technology, and people - with clear steps to follow, ensuring your business gets there.

Provided by

Microsoft has announced a sweeping rebrand of its data governance and compliance products, pulling together data services from Azure Purview and Microsoft 365, to create a unified suite, 'Microsoft Purview'.

Purview will take the names of several Microsoft and 365 products and simply give them a unified identity. For example, 'Microsoft Compliance Manager' is now 'Microsoft Purview Compliance Manager' and 'Office 365 Data Connectors' becomes 'Microsoft Purview Data Connectors'.

The aim is to offer a simplified suite of services that help customers see their assets across an entire data estate, with safeguarding and management tools for cloud endpoints and apps, so that they can manage risks and regulatory compliance as smooth as possible.

Microsoft's thinking is around hybrid work environments which have created gaps and grey areas in data policies and security. Purview addresses those concerns, according to Microsoft, by patching together various tools that protect data for businesses and remote employees.

"Enabling an effective Zero Trust approach requires the ability to govern, protect, and understand data coming from an ever-widening array of endpoints," Microsoft said in a blog post.

Purview will also come with new services and integrations, such as the Data Loss Prevention service for macOS devices, which is now generally available. This adds protection to sensitive files on macOS Catalina (or higher) machines. There is also a 'coauthor' feature for Microsoft 365 applications that use encrypted documents on Android and iOS mobile devices. This also applies to Microsoft 365 apps like Excel, Outlook and Word, as well as Exchange and Teams.

What's more, next month the tech giant will also preview a 'multi-stage' data retention setting within Microsoft Purview Data Lifecycle Management. This will allow labels to be applied to data at the end of a retention period, invoking new retention or deletion setting.

The most productive security teams are going beyond the use of tactical tools for investigation and reporting of security incidents. Instead, they are taking a more strategic, proactive, platform-oriented approach to identifying and assessing security-related risks, proving compliance, and maturing the flexibility and resilience of ongoing operations.

Read this report to learn about the evolution of security monitoring capabilities and discover what comprehensive security technologies companies are investing in to support their work from anywhere (WFA) / hybrid work model.

Provided by

IT security and compliance are key concerns for all organisations. Not only are threat landscapes increasing, poor oversight of their IT and a lack of headcount means compliance tasks have to be done manually.

Having an effective security and risk management approach, which assesses the security of infrastructure & workload environments - and prioritises remediation quickly - is essential.

Download this whitepaper for key considerations around security and compliance in Linux environments, with recommended tools and actionable insight.

Provided by

London-based cyber security unicorn Synk has announced it is acquiring Fugue, a cloud security compliance firm, for an undisclosed fee.

The deal marks Synk's first move into cloud security where it hopes to capitalise on its increasing market value, which is predicted to be worth $77.5 billion by 2026, according to analysts at MarketsandMarkets.

Fugue, a US company headquartered in Maryland, is best-known for its Unified Policy Engine, which covers systems development lifecycles for areas such as cloud posture and configuration codes. The firm also offers API and command-line tools for developer automation, as well as compliance frameworks.

The company was founded in 2013 by former AWS solutions architect, Josh Stella. It originally offered its tech as an "infrastructure-as-code" service before switching to security. And that original focus on code has proved to be a key part of the acquisition as it suits Synk's focus on devops.

Synk plans to integrate Fugue's suite of services into its Developer Security Platform, which it claims will be the industry's first cloud service posture management (CSPM) solution designed by, and for, developers. As such, Synk customers will be the first to benefit from "unmatched" feedback loops that allow developers to secure codes before deployment and maintain their integrity while running them.

"Welcoming the talented Fugue team as our newest Snykers is a fantastic way to kick off 2022," said Peter McKay, CEO, Snyk. "Together, we'll collectively reimagine what cloud security can and should look like for today's modern DevSecOps teams, ensuring more secure innovation can flourish worldwide."

This is Synk's fifth cloud-based acquisition in the last 18 months, following on from deals for CloudSkiff, FissID, Manifold and DeepCode. The London-based cyber security business was one of IT Pro's startups to watch in 2021 and has managed to scale up rapidly since its inception in 2015.

Google Cloud has announced several new resources and offerings to help improve customer success with artificial intelligence.

With its new Custom AI Solutions practice, Google Cloud will help organizations deploy artificial intelligence (AI) and machine learning (ML) applications more efficiently with custom-built Vertex AI solutions.

Vertex AI integrates a number of open-source frameworks, including TensorFlow, PyTorch, and scikit-learn. All ML frameworks and AI branches are supported through custom containers for training and prediction. Additionally, Vertex AI Workbench natively ties into BigQuery, Dataproc, and Spark.

The search giant also intends to triple the size of its Global Delivery Center teams in Argentina, Poland, and India by the end of the year. The centers provide infrastructure for data analytics, hybrid and multi-cloud computing, AI, and ML services. Furthermore, the company plans to build a Google Cloud talent pool in Mexico and Portugal.

Also in line are four new Executive Briefing Centers at Google Cloud campuses in London, Paris, Singapore, and Munich.

The briefing centers will enable the firm to engage with customers, promote Google Cloud services, and provide insights into digital transformation driven by Google Cloud leaders, engineers, and industry experts.

“By bringing this experience to our customers in-region we can foster deeper partnerships and develop cloud solutions that meet their requirements for security, privacy, and digital sovereignty without compromising on functionality or innovation,” said John Jester, vice president of customer experience at Google Cloud.

Lastly, two new leadership positions have been added to Google Cloud's Customer Experience team.

Oracle and Telefónica Tech have joined forces to offer cloud platform as a service and applications to Telefónica Tech’s enterprise and public sector customers.

Oracle Cloud Infrastructure (OCI) services will be integrated into Telefónica Tech's portfolio as part of the partnership.

Through its built-in security capabilities, OCI is described as providing superior performance, high availability, and lower costs for mission-critical workloads and cloud-native environments in large enterprises and public sectors.

Telefónica is also signing up as a host partner for Oracle Cloud Madrid Region to address the rising demand for cloud services in Spain.

Through the new cloud region, businesses and public entities in Spain will be able to access a comprehensive set of cloud services that combine low latency, high performance, and the most advanced security measures, the companies said. Customers will also benefit from business continuity and remain compliant with local data residency and compliance requirements.

In addition to Madrid, Oracle plans to open at least 44 cloud regions by the end of 2022, a move that would make it one of the fastest-growing cloud providers.

Most importantly, Oracle's hybrid and multi-cloud strategy is in line with Telefonica's commitment to hosting customer data regionally or in-country whenever possible and providing customers with a cloud solution that meets their data sovereignty requirements.

"With Oracle Cloud Infrastructure, we are complementing Telefonica's robust cloud services offering with a cloud platform that has seen strong growth over the last year as customers all over the world use it to run their most mission-critical workloads in the cloud," said Albert Triola, SVP and country leader of Oracle Spain.

"Our partnership with Telefonica also comes at a propitious moment for Spain, with the ongoing application of EU recovery funds to boost cloud adoption and business competitiveness in the country. This agreement reaffirms our commitment to providing Spanish businesses and public sector entities with a secure and scalable cloud services platform that helps accelerate the adoption of AI, machine learning and other new technologies in organizations of all sizes and sectors,” added Triola.

As businesses undergo changes in the new post-pandemic world of work in order to stay operational, as well as resilient, these changes are also driven by stakeholders demanding more.

There is an increase in focus on environmental, social and governance (ESG) factors today and as organisations look ahead to next year’s strategy, they need to incorporate sustainable and flexible governance practices in order to be more informed, secure and goal-focussed.

Download this guide to understand five key focus areas that business leaders need to consider as they plan their governance and compliance practices for the coming year.

Provided by

The UK government has announced that Nvidia’s $40 billion (£30 billion) acquisition of ARM will be further scrutinised as part of a "phase two” investigation carried out by the Competitions and Market Authority (CMA).

The watchdog has been given 24 weeks to conduct the inquiry before delivering a final report to digital and culture secretary Nadine Dorries, with the possibility of extending the deadline by up to eight weeks.

During this time, the CMA will consider evidence whether the acquisition of the Cambridge-based semiconductor company by the US chip giant is a threat to competition and national security.

The first phase of the CMA's investigation, which concluded in August and covered competition and jurisdictional issues, determined that the deal could lessen competition across four markets: data centres, Internet of Things, automotive, and gaming.

Today's announcement confirms previous reports published by The Sunday Times over the weekend.

15/11/2021: The UK government is expected to order an in-depth investigation into Nvidia’s $40 billion (£30 billion) acquisition of ARM on grounds of antitrust and national security.

That's according to The Sunday Times, which reported that the newly appointed digital and culture secretary Nadine Dorries will order the Competitions and Market Authority (CMA) to carry out a “phase two” investigation into the acquisition of the Cambridge-based semiconductor company by the US chip giant.

The order is likely to be made this week, the publication claimed, and will see the CMA further scrutinise the potential effects of Softbank’s sale of ARM to Nvidia, which was first announced in September 2020.

Nvidia told IT Pro that it "will continue to work with the UK government to resolve its concerns".

"A Phase Two process would enable us to demonstrate in detail how the transaction will help accelerate ARM and boost competition and innovation, including in the UK," the company's spokesperson said.

In August, following the first phase of its investigation, the CMA found that the acquisition “raises serious competition concerns” that Nvidia’s would prevent its rival chipmakers, including Intel, AMD, Qualcomm, Samsung and Apple, from accessing ARM’s key technologies, “ultimately stifling innovation across a number of important and growing markets”.

“This could end up with consumers missing out on new products, or prices going up,” the watchdog’s chief executive Andrea Coscelli said at the time.

“The chip technology industry is worth billions and is vital to products that businesses and consumers rely on every day. This includes the critical data processing and data centre technology that supports digital businesses across the economy, and the future development of artificial intelligence technologies that will be important to growth industries like robotics and self-driving cars,” he added.

A full investigation into the deal is expected to take around six months. If it is found that the acquisition does, in fact, impact national security, the UK government will have the opportunity to prevent the takeover, or allow it to take place under certain conditions.

On 27 October, the European Commission also launched an “in-depth investigation” into the deal, following reports from earlier this year that the acquisition warrants "serious scrutiny", according to officials and advisors in Brussels. The deal is also reportedly being closely observed by US and Chinese authorities.

The UK has agreed to transition its Digital Services Tax (DST) to a new global tax system proposed earlier this year, avoiding tariffs the US threatened to levy on the country in response to the policy.

The DST, announced in 2018 and introduced in April 2020, imposes a 2% tax on tech giants, the majority of which are based in the US.

The moved prompted criticism from the US government, which in turn threatened tariffs on the UK and other countries that have introduced similar policies.

However, on 8 October 2021, 136 countries agreed a plan for the new system, known as Pillar One and Pillar Two. In Pillar One, the largest and most profitable multinationals will be required to pay tax in countries where they operate, not just where they have their headquarters. The rules would apply to firms with at least a 10% profit margin and see 25% of any profit above this margin reallocated and then subjected to tax in the countries they operate. This is expected to come into effect in 2023.

For Pillar Two, the G7 agreed to implement a 15% global minimum corporation tax, aiming to become effective from 2023. This is set to be operated on a country by country basis, which the government said would create a more level playing field for UK firms and crack down on tax avoidance.

A new deal struck by the US, the UK, France, Italy, Austria, and Spain, will see the adoption of a DST-credit system, which will act as an interim arrangement between the UK’s DST and the start of the new Pillar system.

The US has agreed not to levy tariffs in response to the UK’s previous DST, and the UK will keep the revenue raised from the tax until the Pillar One reforms become operational. Once Pillar One is in effect, companies will be able to use the difference between what they have paid in DST from January 2022, and what they would have paid if Pillar One had been in effect instead, using it as credit against their future corporation tax bill.

The government said this means the UK will not lose out on tax revenue in the transition period, and the DST will then be removed in favour of the global solution.

“Following the landmark deal achieved earlier this month, I am delighted we have agreed a way forward on how we transition from our Digital Services Tax to the newly agreed global tax system,” said Rishi Sunak, the chancellor. “This agreement means that our Digital Services Tax is protected as we move to 2023, so its revenue can continue to fund vital public services.”

The government added that the UK will continue discussions with its global partners in the coming months as they look to start the implementation process in due course.

The 15% Pillar Two tax has been criticised for being too low, with Green New Deal co-founder and accounting professor Richard Murphy arguing that Amazon could dodge this tax as its profit margin is under the 10% mark, and that instead the rate should have been at least 21%.

The UK announced the DST in October 2018, which is a 2% tax on revenues of search engines, social media platforms, and online marketplaces that are profitable and generate over £500 million per year in revenue. In August 2020, it was reported that the UK government was considering dropping the DST to avoid any conflict with the US during trade talks.

In October 2020, it also emerged that Amazon would not be affected by the DST, but smaller traders on its online marketplace would face increased charges. This was seen as a benefit to the company as it would effectively receive a price advantage on competing goods it sells directly to consumers.

Aquant has raised $70 million in a funding round led by Qumra Capital, Insight Partners, and Pitango Growth.

Also participating in the Series C funding round was Lightspeed Venture Partners, Angular Ventures, Schneider Electric Ventures, and Claltech.

Aquant said it will use the capital to expand its product line. Additionally, the firm will add new engineering and client services positions in the US, Europe, and Israel to accelerate its global expansion. The funding will also contribute to the continuous development of Aquant’s artificial intelligence (AI) technologies.

“Customers trust Aquant’s AI-enabled offering, as, unlike generic AI solutions, it is tailored to the service vertical’s needs and delivers clear ROI from day one,” commented Idit Muallem Yedid, partner at Pitango Growth.

Yedid added, “Aquant's insights shed light on areas traditionally perceived as blind spots in service operations and experience. I am excited to be part of Aquant’s journey, as it continues to bring value to all stakeholders of the service experience and roll out additional solutions highly anticipated by its customers.”

Using AI, Aquant's proprietary platform for service intelligence imbibe’s unstructured data, tribal knowledge, and industry insights. The capability enables businesses to make data-driven decisions, identify at-risk customers, analyze asset performance, identify compliance risks, and more.

The platform addresses skilled labor shortages with easy access to account data and service history previously siloed in databases.

“Aquant is revolutionizing service intelligence and is well-positioned to lead this large market given their domain expertise and data savviness,” said Sivan Shamri Dahan, managing partner at Qumra Capital.

“Their technology enables companies to focus on what they’re good at, alleviating one of the most serious business challenges today. We’re very excited to partner with them as they continue their rapid growth in order to significantly improve service experiences.”

IBM expanded its presence in the European financial services market this week by inking a cloud services agreement with Spanish banking giant CaixaBank.

The company signed a multi-year agreement with CaixaBank to run financial software in its cloud infrastructure. Under the deal, the bank will use IBM Cloud for Financial Services to run key software applications while complying with the EU's GDPR data protection rules.

Launched in April, IBM Cloud for Financial Services enables financial institutions to host their software and services in the cloud while complying with regional regulations. It features a framework for financial services that includes a range of applications from IBM and third-party integrated software vendors.

As part of the service, CaixaBank will use IBM's data encryption capabilities. The IT vendor's Cloud Hyper Protect Crypto Services encrypt financial services companies' data while allowing them to keep and manage their own security keys. This means that IBM is unable to decrypt the bank's data.

The CaixaBank deal coincides with the launch of IBM's Spanish multi-zone region (MZR). MZRs feature separate computing facilities connected by low-latency links that offer fail-over continuity. The Spanish zone will offer better regional coverage and address data sovereignty needs.

Other features of the cloud service include compliance monitoring through the IBM Cloud Security and Compliance Center, and the use of isolated computing facilities and network segments, which heightens the privacy level for sensitive financial services workloads. IBM Cloud for Financial Services offers dedicated servers for financial software and can isolate traffic within availability zones.

Listed as the 25th largest bank in Europe, CaixaBank is a ten-year old lender headquartered in Valencia. This year, the company completed the acquisition of rival Bankia for €4.3bn, making it the largest bank in Spain.

IBM has been focusing more heavily on its cloud business over the last few years, leading to a growth in this area against a backdrop of falling overall revenues.

Wipro has added a new studio to its Technology Center in Plano, Texas. Developed in collaboration with ServiceNow, Wipro’s @now Studio will support customers’ digital transformation efforts.

The firm will also leverage the platform to develop novel industry solutions.

Additionally, @now Studio will draw upon ServiceNow's simplified processes and digital workflows to create custom solutions. ServiceNow’s governance, risk, and compliance (GRC) platform will help ensure data integrity and protect against external threats.

“The studio will focus on building competencies, serving as a platform to develop and showcase solutions, accelerating co-selling and co-creation with ServiceNow, and leveraging the ecosystem including universities and leading start-ups,” explained Wipro

Wipro’s Texas Technology Center, which houses the firm’s US cyber defense unit, is an incubator for developing advanced analytics and cloud technologies. @now Studio’s addition supports Wipro’s commitment to create jobs across Texas and hire graduates from Texas universities.

Wipro has also announced plans to open additional studios in Europe and the APMEA region.

“We are excited to strengthen our partnership with ServiceNow,” said Nagendra Bandaru, managing partner of iCORE at Wipro Limited.

Bandaru added, “We look forward to leveraging the @now Studio to increase our ServiceNow capabilities, build solutions across industries, and help our customers simplify processes and automate their workflows. We are also thrilled to expand our presence in Texas and leverage the ecosystem the state has to offer. The Studio also represents an expansion of our cybersecurity capabilities and leverages the local workforce to accelerate innovation. Our collaboration with local universities will enhance employment opportunities and expand our intellectual property in cybersecurity.”

Texas Economic Development Corporation CEO Robert Allen said, “Today’s celebration marks an impressive journey for one of the world’s leading IT companies. Over the past several years, Wipro has grown significantly throughout Texas and the DFW region. Texas continues to be the perfect fit for Wipro as they build capabilities to help their customers innovate, optimize and modernize.”

Regtech can best be described as the use of a range of different technologies to help organisations meet compliance requirements efficiently. Typically it includes technologies like analytics, robotic process automation, machine learning, natural language processing, and, of course, cloud. Yes, all the buzzwords. The outcome should be faster, smoother compliance. Inevitably there should also be reduced generation of paper, easier access to documentation and the elimination of silos. Ultimately, regtech gives organisations a single source of truth for compliance management.

Let’s start with finance

Finance has been the sector that’s pushed ahead fastest with regtech, and that’s no surprise. As Chris Steele, director of banking risk and regulation at KPMG UK tells IT Pro: “Firms in the financial services sector have seen a huge growth in both compliance requirements and the number of staff required to deal with those requirements, with some banks having four times the number of compliance staff than before the last financial crisis.”

He also points out that large banks spend millions of pounds each year on compliance and this, plus the threat of substantial fines, has been a key motivating factor in banks turning to technology.

Other sectors are not immune to the growth of compliance requirements, and have watched the financial sector benefit from using regtech to keep up with the mushrooming regulatory requirements it faces. Think about GDPR and consumer protection in retail, and about the increased regulation of utilities provision for example. As regulation grows, regtech has proved its worth and is expanding from finance into other sectors.

Strategic decisions for the board

Micheal Sheehy, deputy chief compliance officer at global payments provider and eCommerce enabler Payoneer tells IT Pro that boards might be drawn to regtech, because it can help “give [them] peace of mind, knowing their companies are compliant and that the company is doing what it needs to do, when they need to do it”. Nevertheless, regtech is relatively new outside the financial sector, and boards interested in examining the value it might bring could find themselves without a huge number of other organisations to compare themselves with.

Boards need to tread carefully when taking on something completely new, and something so absolutely vital helping to ensure compliance. Sheehy tells IT Pro that boards should pay particular attention to three things: Ensuring their regtech provider can deliver the coverage required – whether that is local or global; getting complete clarity on costs and efficiency savings; and being certain about the potential for mitigating risk, including removal of manual processes and the reduction of the use of paper.

A regtech provider also has to fit in with the organisation’s wider technology. Steele says boards should ask themselves if a particular provider is a good fit with existing systems and future digital transformation plans. “Organisations will have digital and data strategies that are firm-wide and integration with those is key. Any regtech or digital solution will have to operate both within existing frameworks and alongside legacy systems,” he says.

Looking beyond the immediate

For boards – and for shareholders – certainty around compliance is a key plus of implementing regtech, but there are many other benefits as well. “Many regtechs have core aims of reducing cost, cutting through complexity and/or dealing with uncertainty, however technology that supports a better customer experience can also help boards achieve their strategic goals of building and maintaining trust with customers,” Steele points out.

It’s likely there will be considerable disruption as a regtech solution is implemented. Compliance tasks might be spread across several departments or teams, and the locus may need to change. Management and maintenance of paper systems may no longer be necessary, and this could have staffing implications. There will also be a need to either digitise or otherwise manage older paper documents, perhaps entailing a period of additional work as part of the implementation programme. Resources may also need to be devoted to retiring or ensuring appropriate interfacing with legacy document management systems.

As with any technological change, there will be disruption, but the benefits of regtech extend far beyond the important one of improving and streamlining compliance processes. They also extend to improved customer trust, reduced paper usage, longer term financial savings and greater confidence in the organisation at board level and beyond.

Google has announced new security and compliance certifications for its Google Cloud Platform (GCP) to help address security needs of public sector agencies.

Specifically, the new certifications add Cloud DNS to Google Cloud’s list of Federal Risk and Authorization Management Program (FedRAMP) compliant products along with additional government and security compliance certifications across North America, Europe, and Asia.

Cost-effective Cloud DNS automatically scales to handle large volumes of domain name system (DNS) records.

“With the addition of Cloud DNS, our U.S. public sector customers can leverage a broader set of Google Cloud technologies with the assurance they are meeting the highest level of civilian classification - without the limits of a traditional government cloud,” said Google.

Customers seeking to quickly and easily meet FedRAMP High controls can leverage Assured Workloads for Government, Google added. The Assured Workloads for Government service enables GCP customers to create controlled environments in US cloud regions by providing a guided process for building compliance-centric workloads.

The tech giant is also assisting with data protection and security requirements in the APAC region. For instance, India’s Ministry of Electronics and Information Technology has successfully audited Google Cloud on its conformance with MeitY empanelment requirements (registration).

Similarly, in Japan, Google Cloud achieved registration for the Information System Security Management and Assessment Program (ISMAP), a Japanese government system for assessing cloud service providers’ security to participate in public sector projects.

Coming to Australia, Google Cloud was certified through the Information Security Registered Assessors Program (IRAP). This program assesses an organization's security relative to Australian government security requirements.

Google has also gained compliance with the Information Security Standard for Meeting Control Systems in Thailand.

Additionally, Google has received attestations that it has complied with the German Federal Office of Information Security's Cloud Computing Compliance Criteria Catalogue for GCP and G Suite.

“Compliance is critical to building trust in the public sector, and we’re committed to working closely with customers, regulators, and industry organizations to strengthen their compliance frameworks as digital transformation continues to be the norm across governments and industries,” comments Mike Daniels, vice president of global public sector at Google Cloud.

The US is considering implementing a 25% tariff on a selection of British goods that enter the country in retaliation to the UK’s digital services tax (DST).

The goods that the tariff will affect include industrial robots, clothing and ceramics, according to a list published by US officials.

The Office of the United States Trade Representative (USTR) seeks to collect duties on UK goods in the range of the amount of DST that the UK is expected to collect from US companies, which it estimates to be approximately $325 million (£236m) per year.

“The United States is committed to working with its trading partners to resolve its concerns with digital services taxes, and to addressing broader issues of international taxation,” said USTR ambassador Katherine Tai.

“The United States remains committed to reaching an international consensus through the OECD process on international tax issues. However, until such a consensus is reached, we will maintain our options under the Section 301 process, including, if necessary, the imposition of tariffs.”

The UK is not the only country affected by this decision, as are Austria, India, Italy, Spain and Turkey who are also under consideration for the 25% tariffs on goods from their countries as they have implemented a similar DST.

The USTR has dropped its investigations against Brazil, the Czech Republic, the EU and Indonesia for now as these countries have not adopted or implemented the DSTs under consideration when the US began its investigations. It made it clear, however, that if these countries adopt or implement a DST in the future, the USTR may initiate new investigations.

A UK government spokesperson told IT Pro that like other countries around the world, the UK wants to make sure tech firms pay their fair share of tax. The spokesperson said the tax is “reasonable, proportionate and non-discriminatory” before revealing that it is also “temporary”.

“We’re working positively with the US and other international partners to find a global solution to this problem and will remove the DST when that is in place. Should the US proceed to implement these measures, we would consider all options to defend UK interests and industry,” added the spokesperson.

The UK announced its DST in October 2018, which is a 2% tax on revenues of search engines, social media platforms and online marketplaces that are profitable, and generate over £500 million per year in revenue.

The US’s plans to challenge the UK’s DST originated in June of last year under the Trump administration, where it made it clear it would investigate all countries that are adopting this new form of tax. The US claimed that the tax schemes were “designed to unfairly target our companies.”

In August 2020, reports emerged suggesting that the UK government was considering dropping its DST to avoid any conflict with the US during its trade talks.

Furthermore, it was reported that Amazon would not be affected by the DST in the UK, but smaller traders using its online marketplace would face increased charges. This was seen as a benefit for the tech giant, which would effectively gain a price advantage on competing goods it sells directly to consumers.

Despite this, last month the UK government was considering implementing an “Amazon tax” to help the country recover from the COVID pandemic. The Treasury reportedly invited tech firms and retailers to discuss a potential Online Sales Tax, following the news that Amazon’s profits skyrocketed by 51% in 2020.

On 31 December 2020, the UK’s Brexit transition period came to a close, taking us firmly out of the EU. Many issues have been raised over the flow of goods between Britain and its former partners, but the flow of data is a different matter altogether. Data has become an intrinsic part of modern business and with previous rules on international data transfers now at risk of irrelevancy, many organisations are considering how they can adjust their data practices to avoid falling foul of regulators.

With many elements of international data law still up in the air pending various legal cases and policy decisions, we’re joined by Bart Willemsen, VP at Gartner specialising in privacy, to discuss the current regulatory environment and how businesses can prepare themselves for any changes that might be on the way.

Footnotes

• GDPR and Brexit: How will one affect the other?
• Brexit could cost UK firms £1.6bn if data-sharing agreement isn’t reached
• UK data laws after Brexit: Your questions answered
• Facebook will move UK users' data to the US post-Brexit
• The IT Pro Podcast: Cyber security post-Brexit
• EU fires warning shot to UK over post-Brexit US data-sharing
• UK's post-Brexit data deals 'will go further than EU ever could'
• Your guide to overcoming Brexit's data management challenges
• CMA seeks to fill post-Brexit regulatory void as it eyes big tech
• Border force reliant on 26-year-old tech due to digital upgrade delay
• What is EU-US Privacy Shield?

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

The majority of people view compliance as a tick-box exercise, which makes it one of the most boring topics in cyber security. In fact, it’s often met with a collective groan whenever you start talking about it.

The main issue with compliance is that the requirements are, for the most part, poorly written and extremely vague. Companies struggle to meet all the criteria, especially when they have to comply with different requirements at the same time, and I’m pretty sure this confusion around compliance comes from the writing.

Regulations are poorly written and vague

ISO 27001, for example, aims to improve a business’ information security management. Its process includes commands like “conduct a risk assessment”, “define a security policy” and “manage identified risks”. For each of these commands, the requirements are subjective and unclear.

Another example is The Sarbanes-Oxley Act (SOX). It covers all businesses in the United States - and isn’t much better. Section 404 vaguely states that all publicly-traded organisations have to demonstrate “due diligence” in the disclosure of financial information, but doesn’t explain or give any detail about what “due diligence” means.

The Gramm-Leach-Bliley Act (GLBA), meanwhile, demands that US financial institutions explain information-sharing practices to their clients. We can find that financial organisations have to "develop a written information security plan” but the regulation doesn’t offer any advice on how to do that.

Finally, even Lexcel in the United Kingdom, a compliance regulation written by lawyers for lawyers, isn’t clear: "Practices must have an information management policy with procedures for the protection and security of the information assets." For a profession that prides itself on maintaining absolute clarity, I’m quite surprised Lexcel allows this kind of subjectivity in its requirements.

Writing for such a wide audience isn’t easy

It’s true that drafting compliance documents can be tricky, and it isn't easy to write regulations that need to be applicable to all organisations within a particular field. Organisations, for instance, have differences in the way they do business, as well as variations between their IT infrastructures. Writers are also against the clock with compliance; regulations are changing so fast that requirements written today might be out of date tomorrow.

However, some regulations are perfectly clear. Those who write compliance requirements should take note of PCI DSS, to name an example. PCI DSS applies to all organisations that store cardholder data. It’s clear, regularly updated, and everything you need is in one place. Its structure, in terms of requirement, testing procedures and guidance, is a lot clearer than anything else I’ve seen, and there’s very little room for subjectivity.

Another example is the General Data Protection Regulation (GDPR), which is also well-written and detailed. The many articles referring to data protection are specific and implementable. For example, with regards to data access, this passage is totally clear: “Unauthorised access also includes accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of personal data transmitted, stored or otherwise processed”.

Compliance is truly universal

Trying to comply with multiple mandates can quickly become complex. This is why you need to have a good strategy in place. If I can give you one tip, it would be to find the overlaps and commonalities between different regulations before coming up with your strategy.

MSPs can easily step in at this point to assist small and medium-sized businesses (SMBs) struggling to make sense of the different regulations they’re subject to. Compliance that applies to the largest enterprises also apply to the smallest firms and will be trickier to navigate for smaller companies with limited resources. Only around half of MSPs currently manage their customer’s compliance obligations, so it’s a no-brainer for those looking to increase revenue, margins, client loyalty and to differentiate themselves a little more.

To take advantage of this trend, you have to understand that at the core of any compliance mandate is the desire to keep protected data secure, only allowing access to those who need it for business reasons. This is why all you need to do with compliance is to start with the basics: data storage, file auditing and access management. Get these right for your customers, and they’re on their way to demonstrating their willingness to comply.

François Amigorena is the founder and CEO of IS Decisions

Privileged Access Management (PAM) is a vital aspect of risk management and security. It has become one of the fastest growing areas of cyber security in recent years as cyber crime and compliance regulations grow.

Hijackers are drawn to the increase in privileged accounts and the valuable information held there, and so a strong PAM solution is now essential for upholding regulatory compliance and keeping accounts secure. This whitepaper provides an overview of PAM and the catalysts for its growth.

Download it now for a clear outline of the requirements of a strong PAM solution and advice for selecting the right vendor for your business needs.

The increasing complexity of enterprise cloud environments, and the rise of hybrid cloud in particular, is rapidly increasing IT workloads and fuelling a rising demand for automation, Puppet’s CTO has claimed.

During a time when many organisations are being asked to do more with less, the shift from mostly on-prem to a mixture of cloud environments in a relatively short space of time has radically complicated the workloads of CIOs.

Speaking exclusively with IT Pro on the launch of Puppet’s automated Comply platform, Puppet CTO Abby Kearns suggested the increasing complexity of IT infrastructures over as little as the last five years is serving as the main element driving demand for automation.

“The hybrid cloud, and managing across hybrid environments, is the number one driver, honestly, because it’s so complex,” Kearns said. “So many companies started about five years ago to move workloads to the cloud, so we started to see that slow migration, but the cloud wasn’t really set up to mimic the way we were managing on-prem environments.”

Enterprises now have an on-prem environment, a public cloud deployment or perhaps even multiple clouds, with different tools, different workloads and different approaches all in play. Businesses are also using more cloud-native applications and more microservices, so the landscape for IT standards compliance is becoming far more complex.

Puppet’s Comply automation platform is a system designed to cut out many of the traditionally manual processes IT teams and CIOs would manage when ensuring their hardware meets a range of compliance standards.

The product, which will be offered in addition to a compliance automation consultancy service the company already markets, would allow customers to manage their own automation programmes across their IT estate.

Alex Hin, Puppet’s principal product manager, told IT Pro the platform will raise IT visibility, identify compliance shortcomings and remediate these issues.

He explained the need for such software comes from small teams of three to five people suddenly being tasked with making configuration changes on hundreds of thousands of nodes, either on-prem or on the public cloud. This becomes a high investment for the company, requiring a lot of spend and a lot of expertise for all environments to move into compliance.

“That’s really where it comes into play,” Kearns continued, “the idea that automation is really the only route to be able to do that. Because this isn’t just something where you can assign more people to the work. You can’t just throw more people at the problem, you’re going to have to figure out how to automate this as you start to get into the hundreds of thousands of workloads. It’s just a different kind of scale.”

Puppet’s Comply platform will launch in the coming weeks with pre-integrated compatibility with the CIS benchmarks, and further plans to integrate a number of other compliance standards in future. These will extend to include many common standards from DISA, FedRAMP, SOX, HIPAA, and PCI DSS.

The drive to automate, Puppet hopes, will begin to free up time for many organisations that are trying to do more with less, particularly as a result of economic pressures due to COVID-19. One example of a process that Comply will automate is the ‘desired state configuration’ feature. This essentially automatically reverts any configuration changes to a ‘desired state’ if the system detects that the change has led the system to deviate from the particular standard to which it’s adhering to.

“For us, we’ve spent the last six months really investing in a platform-centric approach and the opportunity to really extend into compliance and really build on those capabilities are really powerful for us and our customers,” Kearns added.

“And that’s something we’re going to spend the next several years really continuing to expand on, and really continuing to drive innovation from an automation standpoint, but also from a compliance standpoint as we see those things go hand-in-hand for our customers. “

While Twitter CEO, Jack Dorsey, has made headlines for his handling of President Donald Trump’s controversial tweets, Dorsey’s other company, Square, has received a growing number of customer complaints.

Thousands of Square users have complained the company recently began withholding 20-30% of the money they’ve collected from customers.

On Tuesday, Square confirmed the practice of withholding customer funds in a blog post. Described as a rolling reserve, Square withholds a cut of a seller’s processing volume and then releases it on a rolling basis. This process can take up to 120 days.

Square claims the practice of withholding customer funds targets risky sellers taking prepayments for goods or services provided on a future date. Risky sellers also include companies selling dispute-prone goods or services. Square explained it notifies sellers when it’s placed them in the program.

“We know that reserves can be frustrating for sellers so we use them sparingly, and we spend a lot of time building and adapting our tools based on feedback,” the blog post reads.

According to a recent New York Times investigation, some small businesses have been disproportionately affected by Square’s practice. Jesse Larsen, the owner of PennyWise Contracting, a Washington-based construction company, said Square began withholding 30% of each transaction in early May. To keep his business afloat, Larsen has put hiring on hold and was forced to sell some of his personal property.

Larsen isn’t the only Square customer impacted by Square’s rolling reserves. Over 1,600 business owners have signed an online petition asking Square to end rolling reserves.

“Small businesses can barely survive as it is, and now that Square, Inc. is withholding funds, many more small businesses are going to be closing because of Square,” reads the petition.

Square concluded its blog post by claiming it aims to "be transparent, offer sellers choice, protect buyers, and provide a better experience with Square." Unfortunately for Square, it seems plenty of its customers disagree.

With the increasing adoption of digital technologies in all areas of business come greater challenges in security and compliance. For organisations to succeed in digital transformation (DX) they need to make security and compliance issues of strategic priority.

The good news is the DX, when done right, can help organisations improve security and compliance and provide customers with a level of trust needed to transact digitally.

This whitepaper will provide guidance to organisations on how to better meet today’s security and compliance challenges.

Top IT pros understand the value of a well-oiled IT machine that is efficient, safe, abides by compliance regulations, and fully serves the strategic business needs of the organisation through proper IT governance.

Now that Office 365 is running the productivity show, IT managers need to ensure the Microsoft cloud suite helps meet all these goals – and that means supporting true IT governance, regulatory compliance, and that O365 and its end users comply with the organisation’s security policies.

This whitepaper delves into governance as it applies to O365, exploring why it matters and how to achieve compliance, as well as offering advice on overall IT governance.

The majority of third-party cookie walls used by UK organisations to obtain consent from users contravene strict data protection laws, researchers claim.

Just 11.8% of the content management platforms (CMPs) deployed by UK websites to seek user consent and offer tracking controls meet minimum legal requirements under the General Data Protection Regulation (GDPR).

CMPs, including banners and pop-up windows, are automatically displayed when users visit a website and give a number of options pertaining to consent as well as advanced controls over elements like tracking.

These are designed and distributed by a handful of developers, including Cookiebot, Crownpeak, OneTrust, QuantCast and TrustArc, and used by organisations who prefer this to building their own. Approximately 20% of the top 10,000 UK websites use such a service.

Among the most widely-used CMPs, researchers with Cornell University found that implied consent is universal, as well as dark patterns that guide people into desired behaviour.

“The results of our empirical survey of CMPs today illustrates the extent to which illegal practices prevail, with vendors of CMPs turning a blind eye to - or worse, incentivising - clearly illegal configurations of their systems,” the researchers concluded.

“Enforcement in this area is sorely lacking.

“Designers might help here to design tools for regulators, rather than just for users or for websites. Regulators should also work further upstream and consider placing requirements on the vendors of CMPs to only allow compliant designs to be placed on the market.”

Researchers scraped designs of the five most popular consent-seeking interfaces deployed by the top 10,000 websites in the UK, finding that explicit consent was rare.

The extent of the scale of non-compliance is so broad that even the Information Commissioner's Office (ICO) admitted last year that its cookie wall was non-compliant.

To be fully GDPR-compliant, the researchers stated, cookie walls must offer explicit consent that’s clear and positive, and allow users to reject all options just as easy as it is to accept all options. These notifications must also contain no pre-ticked boxes.

A further in-depth study conducted with 40 participants, moreover, showed how tweaking CMP designs may significantly change the rates of consent.

Organisations, for example, that remove opt-out buttons from the first page of their cookie walls raised consent levels by 22 to 23%. Inversely, offering more granular controls on the first page decreased consent by 8 to 20%.

The key takeaway from the study, according to those involved, was that placing information or controls before the very first layer is almost pointless given it’s largely ignored by users.

Offering genuine controls, therefore, would require organisations to place everything on the first page of any cookie wall.

Alternatively, the design patterns of consent banners could be overhauled to allow for richer and more durable ways to set privacy settings. These would have to be legally binding, however, rather than self-regulatory.

This is difficult because intense lobbying around the EU’s draft ePrivacy Regulation has predominately involved adtech firms campaigning to prevent browsers from having legally-binding elements.

Mozilla is one example of a developer that’s taken action into its own hands, introducing a set of top-level privacy and anti-tracking controls for its Firefox browser last year. Microsoft’s renewed Edge browser, similarly, is packaged with default anti-tracking and baseline cookie blocking.

Preparing for compliance audits is costly and time consuming, and what’s more, meeting compliance regulations doesn’t ensure that controls are effective against the latest cyber threats. Even complaint organisations are breached.

This whitepaper explores how Breach and Attack Simulation (BAS) can ensure your organisation is audit-ready and reveal your exact level of risk across all threat vectors and infrastructure.

Download it now to discover how technology can free teams from repetitive compliance tasks and engage your resources in more strategic initiatives.

The German data regulator has fined the telecoms giant 1&1 almost €10 million for not taking sufficient measures to prevent unauthorised access to customer data.

The company has been punished because it failed to take measures to adequately protect the data of its customers, meaning extensive customer information could be accessed by just providing the name and date of birth.

The lack of protections for customer data constituted a violation of Article 32 of the General Data Protection Regulation (GDPR), according to the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

The Federal Commissioner Ulrich Kelber explained the €9,550,000 fine was a clear sign the data regulator would enforce the protection of fundamental rights under GDPR, and that due consideration was taken in the decision.

Despite the severity of the fine, BfDI also noted that 1&1 was transparent and cooperative during the investigation.

To rectify its processes, the telecoms giant first introduced new authentication steps, before unveiling plans to roll out an authentication procedure with significantly stronger barriers to accessing data.

The BfDI said the fine could have been much higher had 1&1 representatives not been as cooperative as they were during the investigation. The infringement, moreover, was limited to just a handful of customers, despite all customers being at risk.

The data regulator added it would be investigating the customer authentication procedures of rival telecoms companies as a result of its findings.

The agency has been active in recent months, having previously issued a €14.5 million fine against a housing giant for hanging onto the personal and financial data of former and current tenants longer than necessary.

The fines have been adding up since GDPR came into effect in May 2018, but are blown out of the water when compared with the multi-million-pound penalties issued against the likes of BA and Marriot.

Plans to enforce a levy on the revenues of digital companies will go ahead if Boris Johnson wins the forthcoming election, despite Donald Trump's threats of retaliation over France's similar tax plans.

The digital services tax (DST), which imposes a 2% revenue tax on the biggest tech companies like Google and Facebook, is set to come into force from April 2020. It's similar in nature to the 3% levy introduced by the French government.

The prime minister has suggested this will go ahead as planned if he stays in power, despite the fact the US has indicated it would lash out with trading tariffs against countries that have implemented similar measures, like France.

The US announced on Monday that it may slap additional duties of up to 100% on $2.4 billion worth of goods exported from France if the tax went ahead, including cheese, handbags and Champagne.

Any tariffs against an EU member state, however, would also need to be applied to the entire trading bloc due to membership of the customs union.

"On the digital services tax, I do think we need to look at the operation of the big digital companies and the huge revenues they have in this country and the amount of tax that they pay," Johnson told BBC News.

"We need to sort that out. They need to make a fairer contribution."

The pledge to commit to the DST has also been issued through the prism of the general election campaign, and is contained in the Conservative Party manifesto.

The Labour Party has also pledged to impose a version of the DST to pay for the running costs of its public full-fibre network, once it nationalises Openreach in order to lay down the broadband infrastructure.

The Liberal Democrats have pledged to "improve the DST, which suggests the levy could be higher, or even divided into several bands.

The levy, introduced by the chancellor under Theresa May, Phillip Hammond, applies to digital platforms delivering search engines, social media, and online marketplaces that generate more than £500 million per year in revenue. The measures are expected to raise £400 million in tax revenue by 2022/23.

Hammond said at the time the tax aimed to crack down on the "unsustainable and unfair" tax practices that have seen HMRC gather modest sums from tech companies despite gargantuan UK sales.

UK tech companies have since expressed concerns with the measures, with Tech London Advocates' founder Russ Shaw suggesting such a move could stifle entrepreneurialism and innovation.

Trade association techUK, meanwhile, claimed the levy would slow investment and raise consumer costs. The organisation is also concerned the tax would put its members at risk of retaliatory action by the Trump administration.

Trump suggested in July the US would investigate France's proposed tax on the basis it may unfairly target US companies. The plans involve a 3% tax on digital companies with revenues of more than €750m (£670 million), of which at least €25m (£22.4 million) is generated in France.

The EU had previously suggested proposals for a continental tech tax, pushed mainly by the UK, France and Italy, in order to recoup some of the taxation lost through the exploitation of loopholes and aggressive tax avoidance. The plans were dropped in March this year, however, with officials preferring to wait for the G20 group to implement wider tax reforms.

Most IT professionals know that in business, file transfer protocols get things done. They are the processes that move information from one location to another, both internally sharing data within an organisation and passing information from business to business.

For growing enterprises, the daily transfer of files and documents between internal systems and external partners has become so prominent that it's now classified as a core business process. One that can be notoriously time-consuming and unreliable.

With different file transfer protocols available that yield benefits from operational efficiency to added security, the time has come to identify what process your business is utilising and consider whether a change would be beneficial. Managed File Transfer (MFT) is the most advanced of the currently available protocols, with high growth in the MFT industry predicted in the near future.

What is MFT?

MFT is a platform that helps organisations accomplish multiple data-related objectives through managing various file transfer workflows. High volumes of data are moved across time and space, a common need indeed in the data-driven business landscape present today.

Putting the 'manage' in MFT are the internalised add-ons to the file transfer toolkit, setting the protocol apart from competitors. When businesses select MFT software and a vendor that matches their requirements, data and data processes can be managed effectively, with authentication and integration with existing software.

Administration capabilities coupled with automation and security protocols are also typically offered as part of MFT, allowing transfers between systems and users to take place in a secure and controlled fashion. This breeds confidence in end-users that sensitive data is processed according to the rules.

Traditionally, MFT solutions are on-premise installations that focus on integrating with existing internal systems. However, cloud solutions are growing in popularity, providing control over data and workflows without the infrastructure management.

The competition

MFT is just one of three commonly used file transfer protocols, the other two being standard File Transfer Protocol (FTP) and Secure File Transfer (SFT). Each protocol dictates how files are processed and sent, but unsurprisingly each has its own quirks. These nuances can be technical and difficult to interpret without specialist knowledge.

Created in the 1970s, FTP was and still is a fast and efficient method of moving data across a server channel, essential for the booming industries of web development and software. Yet for data-driven enterprises, especially with big data initiatives circling, FTP doesn't provide the volume-scalability, nor the security necessary to transfer sensitive data and ensure compliance with regulations.

SFT can be said to have emerged from FTP as a response to data-security concerns arising from stricter data-protection regulation and, of course, cyber attacks themselves. Such matters weren't overarching at the date of FTP's inception, resulting in generally unsecure and therefore vulnerable communication through its channels. SFT, on the other hand, encrypts the data it transfers over a Secure Shell data stream, essentially making it a more secure and advanced version of FTP, but without the centralised functionality unique to MFT.

Why choose MFT

MFT can also be said to have evolved from FTP, and represents the premium and arguably the most advanced software for transferring files, both in terms of its usability and security.

It's best to think of MFT as a one-pane, centralised transfer system with limbs attending to visibility, security, integrations, and more. Previously, to acquire such benefits when implementing an FTP protocol, clunky add-ons would have to be deployed, making for siloed applications that struggle to communicate.

Ingeniously, this added functionality doesn't correlate with negative user experience. Often, MFT interfaces are designed for transparency and visibility, actually making it an easier tool to navigate than its competitors.

A higher level of security is granted compared to FTP, with additional encryption measures protecting data in transit, helping to prevent data snooping, tampering and leakage. It also has a focus on compliance, meaning businesses don't have to live in fear of GDPR fines.

The major drawback however, and something that typically accompanies greater functionality, is that it's by far the most complex protocol to initially deploy although cloud solutions are gradually making this easier.

At ground-level, MFT provides tangible business benefits, such as faster file transfers and cost and risk reduction, and in turn is opening the door to new mobile, cloud and big data initiatives.

To comply with Trump's August executive order banning US trade with Venezuela, Adobe is cancelling all Venezuelan subscriptions to its software. Users have until 28 October to save the documents within their Adobe Creative Cloud accounts, although Adobe has confirmed that Venezuelans will still be able to access its free Behance service.

The sanctions block the trade of "funds, goods, or services" between the two countries, an effort by the US government to put economic pressure on Venezuelan president Nicols Maduro. The US recently placed 28 Chinese organizations on the Entity List, which similarly prohibits trade between US companies and the blacklisted entities. Tech giant Huawei has also been on the list for most of this year, although it has received a number of temporary exemptions.

Adobe is the first major tech company to react to the sanctions. Others including Google, PayPal, Microsoft, and many other US-based software service providers have not currently made any move to shut down their Venezuelan users' accounts.

Adobe says it is monitoring the situation closely so as to restore user access at the earliest time possible, but there's no indication as to how long subscribers will have to wait. The dilemma has renewed debates over the shortcomings of the subscription model for applications.

Many people depend on Adobe software to run their businesses, and human rights advocates have expressed concern over the impact that revoking software services will have on non-governmental organizations (NGOs) and independent media outlets in the country. The option to buy a license rather than temporarily subscribe to Adobe services could have circumvented such concerns, had the software company not eliminated the option in 2019.

Yet there are many pros that make subscription-based applications an attractive option. Pricing is more accessible, programs can be updated faster, and companies maintain the power to revoke their software from a user. However, Adobe's bowing out of the Venezuelan market has already begun to show how this business model can go wrong.

Adobe has more information for those affected by their compliance with the executive order here.

Google has said it will refuse to pay publishers to list their content in Search's news aggregation, flying in the face of the measures imposed by the EU's copyright reform.

France is the first country to transpose the copyright directive into domestic law, which will take effect in October, and is the first country to clash with a major news aggregator on the matter.

Google said "we sell ads, not search results" and it will not pay publishers for the right to list their content in Search.

The European copyright directive, now known as Article 15 but formerly Article 11, provides news aggregators such as Google and Facebook with two options: either pay publishers to have their content listed as it is now in Search, or drastically reduce the amount of information about the content it lists.

Google has taken the latter option, so while it now lists an article's full headline, hyperlink, image, publisher and a short extract of the piece, it will seriously limit the amount it will display.

This could reduce the 'clickability' of an article and ultimately damage the amount of traffic a digital publisher receives - the exact opposite of the directive's intentions to provide publishers with more opportunities to be paid for their content.

"People trust Google to help them find useful and authoritative information, from a diverse range of sources," said Richard Gingras, VP of news at Google. "To uphold that trust, search results must be determined by relevance - not by commercial partnerships.

"That's why we don't accept payment from anyone to be included in search results. We sell ads, not search results, and every ad on Google is clearly marked. That's also why we don't pay publishers when people click on their links in a search result."

Google warned the EU before the directive was passed about the potential pitfalls that publishers would run into if such a rule was passed into bloc-wide law.

The company ran an experiment with Search at the start of the year which involved limiting the detail in the preview of the content it aggregated and included in Search.

The findings showed that when Google limited the detail in the search listings, even in the least deleterious instances, it led to a 45% reduction in traffic for the publisher. Instead, users turned to other platforms like social media to get their news fix.

"Our experiment demonstrated that many users turned instead to non-news sites, social media platforms, and online video sites - another unintended consequence of legislation that aims to support high-quality journalism. Searches on Google even increased as users sought alternate ways to find information," Google's blog post on the matter explained.

The French press reported an estimated loss between 250 million and 320 million euros per year and had hoped the copyright directive would reverse this loss.

"When the French law comes into force, we will not show preview content in France for a European news publication unless the publisher has taken steps to tell us that's what they want," the tech giant said in a separate blog post.

Before the EU's copyright directive was imposed, Germany had similar pre-existing law that required aggregators to limit the content's 'snippets' or be subject to pay the publisher, according to Politico. As a result, some German publishers explicitly allowed Google to list their content in full for free due to the loss in traffic.

Google argues that it helps publishers grow their traffic for free by providing comprehensive news aggregation which allows users to easily find publishers' content.

"In the world of print, publishers pay newsstands to display their newspapers and magazines so readers can discover them," said Gingras. "Google provides this benefit to publishers at no cost."

The Information Commissioner's Office (ICO) is the UK's data protection watchdog charged with enforcing a host of laws that regulate communications, networking and data protection, although the organisation is most renowned for its role in enforcing the EU's General Data Protection Regulation (GDPR). The ICO is tasked with making sure that businesses within the UK are compliant with strict data protection principles.

The regulator has a number of roles and responsibilities, including investigating organisations that have suffered data breaches, imposing penalties where appropriate, and generally auditing companies for their data collection and storage practices. The ICO also regularly publishes reports on the state of data protection in the UK, emerging threats to the landscape and updates to how it operates.

A number of large organisations have felt the wrath of the ICO in recent years, with Uber, Equifax and Facebook are among the companies issued with maximum fines under the previous legislation. The prospect of massive fines under GDPR, however, have made businesses more alert to reporting incidents, with the watchdog revealing recently that companies were over-reporting data breaches, seemingly out of fear of being as compliant with the legislation as possible.

The history of the ICO

Founded in 1984 as the Data Protection Registrar, the first leader of the organization was Eric Howe. Howe created the first database – the register of data users after the introduction of the Data Protection Act 1998 (DPA). Howe's work raised public awareness around the importance of data protection and the ways businesses collect data about their customers and commercial partners.

Howe was instrumental in raising the profile of the Data Protection Registrar, leading the prosecution of several companies that were found to have inadequate systems to protect the personal data they were collecting. These prosecutions sent a message to all businesses that the registrar had the power to investigate and fine companies in breach of the DPA. Howe retired in 1994 after being awarded a CBE for his services.

In the 1990s, the registrar conducted an internal audit to define further its role in society and its relationship with businesses. This work also ensured that the registrar could adequately enforce the Data Protection Act, which came into force in 1998. In 2000, the Data Protection Register changed its name to the Information Commissioner's Office (ICO) to reflect the changes in the collection, storage, manipulation, exchange, and sale of data. The ICO also began to oversee the Freedom of Information Act.

The ICO we know today has a head office in London, with additional offices in Scotland, Wales and Northern Ireland. With a staff of over 500, the ICO is led by the Commissioner, John Edwards, who took up his post on 3 January 2022. The management board of the ICO also includes several deputy commissioners and non-executive directors.

The ICO is primarily funded through the data protection fees paid by organizations, which account for over 85% of its annual expenditure. Government grants-in-aid supplement this funding to support the ICO's regulation of other laws. Under the Data Protection Act 2018, organizations processing personal data must pay a data protection fee unless exempt. Personal data includes information such as names, addresses, or telephone numbers. 

From 1 April 2022 to 31 March 2023, the ICO collected approximately £66 million through the data protection fee, up from £62 million in the previous year. Additionally, the ICO's regulation of other legislation is funded by grant-in-aid, receiving £10,298,000 from April 2022 to March 2023, compared to £7,578,000 in 2021/22.

Who is the Information Commissioner?

The Commissioner is the most senior official at the ICO. Appointed by the Crown, there have been six Commissioners:

The Commissioner is also not a neutral party. Able to influence debate and even policy, the Commissioner oversees data privacy rights. 

For example, with the rise of LFR (live facial recognition) technologies, the Commissioner openly stated that the technology poses "a potential threat to privacy." 

In a blog post, then Commissioner, Elizabeth Denham, said: "We understand the purpose is to catch criminals. However, these trials also represent thousands of people's widespread processing of biometric data as they go about their daily lives. I believe that there needs to be demonstrable evidence that the technology is necessary, proportionate, and effective considering the invasiveness of LFR."

What are the responsibilities of the ICO?

The key responsibility of the ICO is to enforce the Data Protection Act 2018 and, by extension, GDPR. However, the ICO is also the enforcement organization for several other pieces of legislation, including:

• Privacy and Electronic Communications (EC Directive) Regulations 2003
• The Freedom of Information Act 2000
• Environmental Protection Public Sector Information Regulations 2004
• Investigatory Powers Act 2016
• Enterprise Act 2002
• The eIDAS (Electronic Identification and Trust Services) Regulation 2014
• Re-use of Public Sector Information Regulations 2015
• The Network and Information Systems Regulation 2018

All of these regulations have the collection and management of data at their core. The ICO, in effect, policies these Acts and regulations to safeguard personal privacy in an environment where data has become highly valuable. The lesser-known eIDAS is important to oversee, as this regulation governs the use of cookies and how digital services are secured.

What powers does the ICO have?

When GDPR came into force, many news headlines covered the substantial fines businesses could face for any breach of the regulations. 

The maximum statutory fine is $23 million (£17.5 million) or 4% of the business's annual turnover – whichever is the higher.

In 2023 alone, ICO fines topped $18 million (£14 million), with the largest fine being handed to TikTok for breaching the personal data privacy of children using their platform. The reality is that the ICO will consider many factors before deciding on the level of fine for the breach or infringement.

The ICO states: "Fines aren't suitable for every breach. Our fines and penalties may grab the headlines, but we know that our work with organizations, helping you to make changes and improvements to comply with the law, is the most effective way of reducing mistakes and misuse of people's data. We're here to help you get data protection right, through our events and our support and advice services. If things go wrong, we want to work with you to decide what improvements we expect from you and provide advice to help you get it right in the future."

Recently, the ICO has been consulting on its Data Protection Financing Guidance, which closed in November 2023. The results of this consultation and the responses from the ICO should be read by all data controllers to understand the five-point process the ICO will use to decide on the appropriate level of fine.

The ICO's powers are far-reaching. The Commissioner can comment on legislation and technologies in development that could impact data privacy. The ICO often makes spot checks to assess how businesses are managing their data protection responsibilities, such as whether DPIAs (Data Protection Impact Assessments) are being carried out regularly.

As a data privacy watchdog, the ICO can prosecute or levy fines. However, the ICO has always striven to avoid being too adversarial. Indeed, it has developed many resources to help businesses more easily comply with data protection regulations.

How the ICO plans to adapt to new technology

The ICO must adapt to rapidly evolving technological and regulatory landscapes to meet future data privacy needs. This includes the rise of artificial intelligence (AI), machine learning, and the Internet of Things (IoT). This will require developing advanced technical expertise to evaluate and regulate these technologies, ensuring they are used responsibly and ethically.

With data flows crossing borders, aligning with global data protection standards and fostering cooperation with international regulators will be crucial. This can help address the challenges posed by global data breaches and multinational corporations' data practices. Empowering individuals with knowledge about their data rights and how to protect their personal information is essential. The ICO can enhance its outreach programs and leverage digital platforms to engage with the public more effectively.

As the value of personal data increases, the large data aggregators will continue to come under the spotlight of the ICO. Meta's plans to train AI's on the personal data they hold of billions of users was tempered by the ICO, with Stephen Almond, executive director of Regulatory Risk at the ICO, stating in June 2024: 

"We are pleased that Meta has reflected on the concerns we shared from users of their service in the UK and responded to our request to pause and review plans to use Facebook and Instagram user data to train generative AI. In order to get the most out of generative AI and the opportunities it brings, it is crucial that the public can trust that their privacy rights will be respected from the outset. We will continue to monitor major developers of generative AI, including Meta, to review the safeguards they have put in place and ensure the information rights of UK users are protected."

John Edwards on AI and emerging technology

The ICO will oversee emerging technologies that are built on large datasets. Indeed, a speech given by Commissioner John Edwards began by focusing on the phenomenal expansion of ChatGPT.

Edwards stated: "People were simultaneously amused by the novelty of it and unnerved by its power. Questions started being asked about where ChatGPT was getting its information from and the pros and cons of using personal data to train the model. Our colleagues in Italy, the Garante, banned ChatGPT due to concerns over how it used people's personal information.

"AI and emerging tech can be a massive force for good. The strides forward we've made in terms of healthcare, productivity, and transportation have been massive.

However, organizations that use these technologies must be transparent with their users about how their information will be processed. It's the only way we continue to reap the benefits of AI and emerging technologies. I said at the end of last year that 2024 cannot be the year that people lose trust in AI. I stand by that statement today.”

Edwards concluded: "Ever since the ICO's inception in 1984, data protection law has been the principal form of regulation for new technologies. The same principles apply now as they always have – you need to look after people's information, be transparent about how you're using it and ensure its accurate."

Enterprise Data Strategy (ICO25)

As the future of data privacy evolves, so too has the ICO. In 2022, the organization launched its Enterprise Data Strategy (ICO25) to ensure it would be ready as a regulator to manage the fast pace of technological change taking place as you read this.

The Commissioner states: "As a regulator, we're shifting our guidance away from 'don't do' to 'how to'. In a similar way, our data strategy is setting an ambitious vision to 'show, not tell'. We aspire to be an exemplar for responsible innovation in the use of data – one that can inspire and guide others through our own transformation."

When the EU's General Data Protection Regulation came into force in May 2018, perhaps it's most contentious and fear-inducing component was its significantly harsher approach to sanctions.

The regulation grants data authorities far greater powers to bring companies to account. In the UK, the Information Commissioner's Office (ICO) can now issue fines of up to 4% of a company's annual turnover, or €20 million (whichever is greater) for the worst data offences.

Although GDPR is a European regulation, more or less the same provisions, including the tougher fines, were introduced into UK law as part of the UK's Data Protection Act 2018, which worked to harmonise laws between the UK and the EU - and will continue to operate despite Brexit, after UK GDPR was baked into British law as part of the withdrawal process.

Hundreds of fines have already been levied against companies across Europe, the vast majority of which were in the low thousands for fairly minor infractions. However, there have been a handful of major fines that have hit the upper threshold of what's possible.

In January 2020, French data protection authority CNIL fined Google €50 million over a lack of transparency and for failing to secure appropriate consent as part of its advertisement model. This has since been followed by several harsher fines, including €210 million in January against Facebook and Google for making it difficult for users to reject cookies. In the UK, meanwhile. two of the largest prospective fines were levied against British Airways (£183 million) and Marriott International (£99 million), although both cases were subsequently watered down. One of the largest, if not the largest, GDPR fine has been issued against WhatsApp, which was fined €225 million over its obscure data sharing policies, after initially only being issued with €50 million notice of intent to fine.

A tiered approach to fines

According to Article 83 of the new data protection rules, regulators will adhere to a two-tiered structure for the administration of sanctions. The higher tier carries potential fines of up to €20 million, or 4% of global annual turnover, whichever is higher. The lower tier carries a maximum fine of €10 million, or 2% of annual turnover, whichever is higher.

Article 83 stipulates that lower-tier fines should be typically handed out to those organisations who have failed to integrate data protection policies "by design and by default" into the services they offer to the public. Additionally, any company that fails to cooperate with a data regulator, regardless of the nature of a breach, is also likely to fall into this tier.

The lower tier also marks out companies that have failed to assign a data protection officer (when it's clear that one is required), those companies that fail to inform data subjects as and when their personal data is compromised, and those that fail to keep adequate records of the data they are processing.

The often panic-inducing higher tier will, on the other hand, apply only for the most serious GDPR infringements, including breaching subjects' data and privacy rights, not following the basic principles of data protection, and refusing to comply with demands and requests from the data regulator, such as a refusal to comply with a previous warning or an order on processing data. How an organisation handles user consent will also be considered.

Will you always be fined the maximum?

Despite the claims of many irresponsible lawyers and software companies in the run up to GDPR, the vast majority of enforcement actions from regulators will fall far short of the multi-million Euro fines technically possible. That's if enforcement even gets that far, as provided a company is responsible and willing to engage with regulators, sanctions can be mitigated and even scaled back.

The regulations also make it clear that any fine will need to be administered on a case-by-case basis, and in the spirit of being "effective, proportionate and dissuasive". This means regulators are required to assess the nature of each individual infringement, including how serious it is, the duration of the incident, its scope, the extent to which the company took steps to prevent it, and ultimately how likely the incident is to infringe on the rights of the company's data subjects.

How negligent a company has been is typically the biggest factor in determining a resulting fine, and is often cited as the reason why financial sanctions are justified. The ICO has repeatedly stated that its goal is to work alongside companies to maintain compliance and that it does not purely exist to strike fear into those it regulates - a clear willingness to get data protection right will go a long way.

That willingness, however, will need to be demonstrable. Showing you took every reasonable step to enforce data protection rules across both your organisation and supply chains, ensuring that data was not processed unnecessarily, and reporting data breaches as quickly as possible, are all clear signs of a compliant company.

James Pressley, associate solicitor at law firm Kirwans, cited a case where the ICO issued Carphone Warehouse a fine under the Data Protection Act 1998 of £400,000 - 80% of the maximum fine, also citing WhatsApp's purchase by Facebook and the undertaking the messaging service gave to the ICO not to transfer any WhatsApp UK user data to Facebook.

"When dealing with organisations of that size, it is easy to imagine that fines of the new GDPR limits could be considered 'proportionate'," he warned.

How is the ICO operating post-GDPR?

The ICO, charged with enforcing data regulation in the UK, has gained a reputation for being a conservative regulator, inclined towards leniency.

Given the scale and severity of fines possible under GDPR - 40 times greater than the maximum £500,000 under the Data Protection Act 1998 - all eyes were on the ICO as to how it would operate.

"And while fines may be the sledgehammer in our toolbox, we have access to lots of other tools that are well-suited to the task at hand and just as effective," the former ICO chief, Elizabeth Denham, said in a speech some years ago. In the same speech, she reassured organisations that "predictions of massive fines under the GDPR that simply scale up penalties we've issued under the Data Protection Act are nonsense," indicating the ICO will continue to operate in much of a similar vein to how it has been thus far, with fines a last resort.

This approach is something that's very much been borne out as a reality, with the ICO keen to co-operate with businesses to ensure that steps are taken to rectify violations of the law once they've been determined. This is evident in the way the regulaor dramatically scaled back the fines issued against BA and Marriott.

Denham, at the time, also dismissed any predictions of a 'grace period' for compliance, in which the ICO would be lenient in the first few months following the introduction of GDPR, given businesses have had two years to prepare. In reality, though, the ICO waited some time before issuing severe penalties, given the time it takes to investigate cases and publish findings. This is something that's been replicated all over Europe, with data protection offices only in the last couple of years beginning to come out with the heavy financial penalties many first predicted.

"It would be entirely consistent with that approach for the ICO to demonstrate its new powers by imposing substantial fines, which would serve the dual purpose of bringing many private organisations into line," Pressley continued. She also indicated that infringements in any areas previously covered by the Data Protection Act 1998 would be viewed dimly, something else which has come to fruition. Conversely, organisations that self-report areas of non-compliance have been looked on favourably.

Video sharing apps such as Facebook, Instagram and YouTube will soon be fined millions of pounds for hosting harmful videos as part of the government's ongoing commitment to enforce EU laws.

The government will hand communications regulator Ofcom new policing and sanctioning powers to protect children from violent, abusive and pornographic content, according to the Telegraph.

The tech giants could face a fine of up to 5% of the company's revenue as well as having their platform potentially banned in the UK if they fail to comply with Ofcom's rulings.

The handoff of powers to Ofcom is being made to comply with the UK's current obligations it has to the EU. Specifically, its Audiovisual Media Service Directive (AVMS) which aims to deliver greater protections for children, as well as preserving cultural diversity and guaranteeing the independence of national media regulators.

However, the regulator may never get to enjoy these powers as the proposed date of Ofcom's new role would be 19 September 2020, beyond the current withdrawal date for the UK leaving the EU. Once it leaves the bloc, the UK will no longer be legally obligated to enforce the AVMS directive.

"The implementation of the AVMSD is required as part of the United Kingdom's obligations arising from its membership of the European Union and until the UK formally leaves the European Union all of its obligations remain in force," said a spokesman for the Department for Digital, Culture, Media and Sport to the BBC.

"If the UK leaves the European Union without a deal, we will not be bound to transpose the AVMSD into UK law."

Under the same rules, the apps in question will also face fines for improper implementation of robust age verification systems and parental controls on videos.

Social media platforms have faced heightened scrutiny this year after a number of incidents involving terrorist attacks being broadcast over online platforms. Operators, including Facebook, have been accused of not removing said videos expeditiously.

"1.5 million copies of the video had to be removed by Facebook - and could still be found on Youtube for as long as eight hours after it was first posted - is a stark reminder that we need to do more both to remove this content, and stop it going online in the first place," said former Prime Minister Theresa May at the Online Extremism Summit in Paris.

Facebook, Twitter and YouTube all faced harsh criticism after the New Zealand shooter's video evaded all three sites' harmful content algorithms.

Google, which owns YouTube, has previously boasted impressive figures concerning the accuracy of its machine learning-driven AI algorithms which first came into effect on YouTube's platform in 2017.

Within a year after its implementation, most content that was violent or extremist in nature was removed from the site with fewer than 10 views.

The UK's National Crime Agency (NCA) has allegedly harvested a swathe of files from EU databases to help with the country's policing in a post-Brexit world.

That's according to a leaked document seen by the Guardian which detailed the findings. The report said the UK transferred 54,000 EU alerts from its Schengen Information System (SIS II) database to the Police National Computer (PNC) as the country may lose access to EU crime data when 31 October rolls around.

The report stated that crime-fighting is an increasingly international venture requiring cross-border collaboration to be successful in cases. While the transferring of these alerts will keep Britain's police informed for a while, the country's access to the database is uncertain due to the risk of a no-deal Brexit.

"Undoubtedly, uncertainty about the UK's future relationship with the EU has increased, due to the resignation of the PM and the ensuing leadership contest," read the report by David Armond, former NCA deputy director general.

"All Brexit scenarios are now back on the table, including exiting the EU with or without a deal, a further extension to the process and a second referendum," it added. "A no-deal Brexit at the end of October is now a possibility, which means that the priority for ICCC, the [International Crime Bureau] and police forces should be to focus on the mitigation of increased risks due to the loss of access to SIS II alerts."

Michael Gove, chancellor of the Duchy of Lancaster, wrote on Sunday that a no-deal Brexit is "a very real prospect", meaning that if a deal can't be struck by the 31 October deadline, the UK will lose access to vital crime-fighting systems provided to us by the EU, as well as European arrest warrants and investigation orders.

"The EU's leaders have, so far, said they will not change their approach [to negotiating with Britain regarding a Brexit deal] - it's the unreformed withdrawal agreement, take it or leave it," said Gove.

"We still hope they will change their minds, but we must operate on the assumption that they will not. No deal is now a very real prospect, and we must make sure that we are ready," he added.

Individual nation-states are being urged to upload SIS II alerts to Interpol where the UK can still legally access the information once it left the EU, according to the leaked report.

IT Pro contacted the NCA and the Cabinet Office for comment but neither replied at the time of publication.

Criminal databases aren't the only thing the UK could expect to lose access to if it leaves the EU, businesses may also find it difficult to receive data from countries in the EU due to the recent scrutiny placed on the current mechanism used by businesses to transfer data within the EU.

Standard contractual clauses (SCCs) allow one organisation to set data protection rules into a contract with another organisation which allows data transfer to remain legal and compliant with GDPR. It's also the mechanism that UK businesses were relying on in a post-Brexit world.

The European Court of Justice (ECJ) is currently ruling on whether to declare these SCCs invalid and a worst-case scenario could see data flow halted between UK and EU businesses.

In any case, UK businesses have been advised to review whether their methods of cross-border data transfer would need altering if the ECJ ruled against SCCs. In some cases, organisations may need to switch to a UK-based data processor but that could incur a greater cost.