High profile GDPR fines having greatest impact on UK cyber security spend

  • Latest judgements against British Airways and Marriott producing fear of fines (32%) and increasing board level involvement with cyber security within financial firms
  • Only 22% of UK firms believe their cyber security spending is at an ‘adequate level’.
  • Data Loss Prevention technology tops cyber security investment charts, followed by Database security and Regulatory compliance.

22nd August 2019, Theale UK – New research by data security company, Clearswift, has shown that the recent large GDPR fines against enterprise giants British Airways and Marriott have had a ripple effect on board level involvement and spending plans in relation to cyber security within UK financial firms. 

The research, which surveyed senior business decision makers within enterprise financial organisations in the UK, highlighted the Information Commission Officer’s (ICO) recent judgements, £183M proposed fine for BA and £99M proposed fine for Marriott, as a key turning point in addressing their own cyber security. Almost one third of companies (32%) referenced recent GDPR fines against British Airways and Marriott International as being the primary reason for an increase in board level involvement and/or provision for IT security spending.

“It has been over a year since GDPR has been enforced and organisations were wondering if there were any teeth behind the regulations,” said Dr Guy Bunker, CTO at Clearswift. “These fines have clearly sent shockwaves into the industry and are now serving as a blueprint for how the ICO will handle cases of this nature. By giving out such large ‘intentions to fine’ notices, the ICO has delivered a message that it is not afraid to reprimand household names,” he continued.

“The board is now sitting up and taking notice of GDPR compliance and the role cyber security plays in it. However, it is not just about taking notice, it is the need to invest to maximise their ability to keep the organization safe from new threats. Revisiting their ‘defence in depth’ strategy to augment with enhanced security solutions including both the boundary and the cloud, and implementing more stringent policies is critical to securing the critical information they hold within the organisation,” added Dr Bunker.

Other key threats identified by respondents included supply chain threats (25%), where attackers seek to damage an organisation by targeting less-secure elements in the supply network, like the high profile 2018 Not Petya attack. Ransomware attacks (24%), such as the infamous WannaCry attack in 2017, where malicious software denies access to a computer system or critical data until a ransom is paid were also high up the list.

Interestingly, when looking solely at companies with over 5,000 employees, fear of Ransomware was perceived to be the key reason why firms are bolstering their spending. This isn’t surprising when you consider firms infected with ransomware have, in some cases, ended up reverting to pen and paper while the outbreak was dealt with. 

When asked about spending levels, the majority of financial businesses would like to see an increase in cyber security investment (73%) with almost one in five (17%) UK firms surveyed reporting that their budgets currently stood ‘well below the adequate level’. Fortunately, this figure dropped dramatically (to 5%) when looking at firms with over 5,000 employees, a possible sign that larger firms have already made additional investment to deal with the ever-changing cyber threatscape.

When asked where their organisation currently focuses its cyber security investment, Data Loss Prevention (DLP) technology was a primary area for over half (53%) of UK financial businesses, followed by Database security (42%), Regulatory Compliance (40%) and Advanced Threat Protection (40%).

Bunker also said: “Increasing investment in the latest data loss prevention solutions will help mitigate inadvertent and malicious data loss risks. Furthermore, with GDPR, organisations need to be aware that receiving unauthorised data can also cause issues. Organisations need to better understand how information flows through the organisation in order to tailor security solutions around how the business operates. In doing so, it will highlight where the biggest risks are and how the most cost-effective solutions can be deployed to increase protection and prevent a hefty fine.”

Notes to editors:

This research was conducted by technology research firm, Vanson Bourne, on behalf of Clearswift. 100 senior business decision makers from financial organisations in the UK were polled to map the attitudes of businesses and employees relating to cyber security.

For further information or to arrange a briefing please contact:

Niall Moran (on behalf of Clearswift)


0203 141 2989

About Clearswift

Over 70% of Clearswift clients operate within critical national infrastructure, including defence organisations, government agencies and financial institutions, all of which demand the most advanced cyber threat prevention and information security solutions. Working closely with these clients over two decades has enabled Clearswift to gain a clear understanding of the cyber challenges they face, keep abreast of their evolving threatscape, and support compliance with the complex regulatory environment within which they operate.

The united approach to working with clients has ultimately driven the specialised development of the award winning Clearswift product portfolio, which is backed up with a superior 24/7 customer support service and an extensive channel partner network across the globe.

As a global organisation, Clearswift is headquartered in the United Kingdom, with offices in the United States, Germany, Australia and Japan.