London – UK data protection regulation costs UK technology businesses an estimated £5.3 billion a year in compliance and is holding back innovation and investment, according to a new survey commissioned by the Computer & Communications Industry Association.
Freshwater Strategy surveyed 113 senior decision-makers at UK technology and data-intensive businesses. The £5.3 billion annual figure represents the direct cost of complying with data protection rules, including spending on staff, advisers, systems and other compliance requirements. It does not include the economic cost of delayed product launches, foregone business activities or technologies that companies choose not to adopt, meaning the overall cost is likely substantially higher.
The survey found:
- 57% describe UK data protection regulation as a burden, while 69% say compliance costs have increased over the past 5 to 10 years.
- Even micro firms report spending about £17,000 a year each on data protection compliance. Large firms report spending an average of £5.7m a year each.
- 52% have been prevented from undertaking a business activity because of data protection regulation, and 48% say compliance has diverted technical staff from product development.
- 47% say they could create more value from data they already hold if the rules were clearer.
- Businesses report avoiding beneficial uses of data, scaling back data use, delaying products and, in some cases, launching products outside the UK first.
- If the regulatory burden were eased, businesses say they would use data more extensively (NET +66), adopt AI (NET +60) and launch new services more quickly (NET +48).
Respondents were committed to protecting consumer privacy, with NET +30 support for maintaining strong protections for personal data, even where this increases business compliance costs. However, uncertainty about how the rules are enforced is a bigger problem than the rules themselves (NET +56) and most said that the risk of getting data protection wrong felt disproportionate to the actual risks to individuals (NET +57).
The following may be attributed to Matthew Sinclair, Director of CCIA UK:
“British businesses need clear, proportionate rules that protect people’s privacy and allow companies to innovate, and this research shows that is not what they get now. The newly appointed Information Commissioner should make this an urgent priority, with Ministers and Parliament insisting the regulator work positively with businesses to unlock new innovations while keeping consumer data safe. The Regulating for Growth Bill is a vital upcoming opportunity to ensure that the data regulator is supporting rather than undermining the UK’s success and competitiveness as a thriving digital economy.”
