Studying Data Privacy Management in Small and Medium-Sized IT Companies

Today, poorly implemented information security and data privacy measures may cause significant threats to companies’ existence and business continuity. Additionally, European Union has established strong data protection regulation rules for companies operating within EU. In order to be compliant with these new rules and regulations, organizations have to put a lot of resources to create data privacy policies and plans as well as to adjust tools to manage data privacy requests and fullfill privacy by design and privacy by default principles. Especially for small and medium-sized (SME) Information Technology (IT) firms and software development organizations with limited resources, new GDPR legislation and stricter requirements for information security have caused several challenges and uncertainty on what is adequate level of data privacy. In this paper, we focus on exploring Finnish IT SMEs and their actions and feelings on data privacy and information security. The research problem of this study is: How small and medium sized companies have prepared for growing data privacy and information security requirements? The main contribution of this paper is to show how small and medium sized IT companies in Northern Savo region did prepare for EU data privacy regulation and what types of challenges did exist in the GDPR preparation phase.