Skip to content
Schedule a Call
Call Now

Summary of IAPP & EY Annual Privacy Governance Report 2021

Article by Tsaaro

7 min read

IAPP in collaboration with EY and EY Law produced the “IAPP EY Annual Privacy Governance Report” which analyzes the state of the privacy profession in 2021 examining the ongoing effects of the COVID-19 pandemic on the privacy profession, including the evolution of remote/hybrid/office work.

The report also covers the future of business travel, legal compliance issues related to the EU General Data Protection Regulation and California Consumer Privacy Act, as well as the progress of organizations in adapting to new laws, including the California Privacy Rights Act and other U.S. state laws, as well as Brazil’s General Data Protection Law.

Major Privacy Law Updates around the World:

1. In July, the most important GDPR decision was issued when Luxembourg’s National Commission for Data Protection imposed an unprecedented 746 million euro fine on Amazon for alleged violations of the GDPR.
2. Recently the Irish Data Protection Commission’s 225 million euro fine against WhatsApp is more than the total of all other GDPR fines that have been imposed since the law went into effect.
3. In August, China adopted the Personal Information Protection Law, which is set to go into effect Nov. 1.
4. South Africa’s Protection of Personal Information IAPP-EY Annual Privacy Governance Report 2021 Act came substantively into force July 1.
5. At the state-level in the U.S., privacy laws continue to advance from passage to implementation and enforcement.

Major Highlights from the Report:
1. Privacy budgets have increased significantly since last year, with the average privacy spend among organizations being $873,000.
2. 45% of organizations are planning to hire at least one or two new privacy professionals over the next six months.
3. Most firms said they usually take at least a few days to respond to DSRs, with nearly 4 in 10 saying they take at least a week.
4. Regarding CCPA compliance, 26% of firms to which the law is applicable reported being in full compliance, while 41% reported being very compliant.
5. 20% of firms to which the GDPR is applicable rated themselves as fully compliant with the law, while 43% said they are very compliant.
6. Six in 10 organizations have a dedicated team in place for handling DSRs, with access requests and right-to-erasure requests being the two most common.
7. Top 5 data records collected from employees during Covid 19 were: Health status information, Temperature, Covid 19 test results, Contact tracing information, and vaccination records.
8. Most businesses that transfer data out of the EU have either continued to rely on or switched to using SCCs, which were updated by the European Commission in June.
9. 30% of the Privacy professionals report to the General Counsel, 18% to the CEO, and 16% to the CCO while the rest of them report to VP, Board of Directors, or the CFO.
10. The most common job title for an organization’s privacy leader is Chief Privacy Officer, followed by DPO and Director of Privacy.

Some privacy management statistics from the past year:

1. The most common metrics used for benchmarking involve incident response, impact assessments, training, and DSRs. Access requests and right-to-erasure requests are the most common DSRs across firms, with at least two-thirds receiving them.

2. Some of the most common audits or certifications that organizations require from entities that process their data include ISO 27001 (28%), SOC2 Privacy (22%), or some internally developed assessment (17%).

3. More than half of organizations handle DSRs manually, while 1 in 3 has automated the process. Organizations most frequently use privacy technologies for DSRs (40%), data mapping (39%), cookie consent/website scanning (39%), privacy and data protection impact assessments (37%), consent management (35%), and third-party risk management (32%).

4. 67% of survey respondents this year have a CIPP credential, up from an average of about 59% over the past 3 years.

5. Nearly 6 in 10 privacy pros said that complying with cross-border data transfer laws is their most difficult task.

6. Nearly half (48%) of firms have a single global privacy strategy.

7. More than 7 in 10 firms transfer data from the EU to a third country; SCCs are used by nearly all (94%) of them.

8. 10% of firms chose to localize data, stop transfers or halt related services as a result of the CJEU’s ‘Schrems II’ decision.

9. 3 in 4 firms have a DPO, with 15% outsourcing the role (up from 8% in 2020)

10. 6 in 10 organizations with an in-house DPO said the position handles matters across all countries, while 4 in 10 have country-specific DPOs.

11. The countries most likely to have a dedicated DPO are Germany, the UK, and Brazil.

12. Firms have an average of 18 full- or part-time privacy staff, with more in the EU than the US.

13. Privacy spending has increased significantly since 2020, with the typical (median) organization’s privacy budget being $350K.

14. 6 in 10 privacy pros expect their budget to increase over the next 12 months, while almost none expect it to decrease.

15. Privacy policies, training, and incident response are among the tasks virtually all privacy teams are responsible for.

16. US-based privacy pros focus more on vendors, CCPA and LGPD, and consumer sentiment than EU.

17. 6 in 10 firms have had a privacy program for 3 to 9 years, up from just half in 2020.

18. 8 in 10 of the privacy professional respondents of the survey work for a firm headquartered in either the US (54%), EU (16%), or UK (10%). About half (47%) of respondents are based in the US, 19% in the EU, and 14% in the UK.

Report source credits: EY

1,132 thoughts on “Summary of IAPP & EY Annual Privacy Governance Report 2021”

  3. khodrocamp.ir

    I blog frequently and I truly appreciate your information.
    This article has really peaked my interest.
    I’m going to take a note of your website and keep checking for new information about once a week.

    I subscribed to your Feed as well.

  5. good appliance repair near me

    Looking for reliable appliance repair services you can trust? Our expert technicians are here to get your appliances running smoothly again. Whether it’s a malfunctioning refrigerator, a broken dishwasher, or a faulty washer and dryer, we provide fast, efficient, and affordable repairs. With years of experience and a commitment to quality, we ensure that every job is done right the first time. We pride ourselves on transparent pricing, honest assessments, and exceptional customer service. Don’t let appliance issues disrupt your day—call us today and get back to normal with our reliable repair services. Your satisfaction is our top priority!

  36. Rene Gainor

    I would like to thnkx for the efforts you have put in writing this blog. I am hoping the same high-grade blog post from you in the upcoming as well. In fact your creative writing abilities has inspired me to get my own blog now. Really the blogging is spreading its wings quickly. Your write up is a good example of it.

  380. kjwwbpdxr

    Blinds and Buy-in Information Book your next VIP reservation now. 2023 Everglades Poker OpenSeminole Hard Rock Hotel & CasinoHollywood, FloridaEvent 1$150 Big Stack No-Limit Hold’em (Re-Entry)Entries: 1,423Prize Pool: $165,068September 20-24, 2023 To make an appointment at Rock Spa® & Salon or for more information, contact our Customer Care team at 1 (866) 502-7529. Check out today’s hottest entertainment and comedy acts in our Vine Showroom. Voted Gold in Best Night Club in the Finger Lakes, the Vine is acoustically superior to any other entertainment site in the area. Fill out the form below to receive personalized emails on the latest specials and promotions at Bally’s Twin River Lincoln Casino Resort.  Postage Give your luck a spin on our roulette wheels, featuring state-of-the-art game displays and world-premiere higher payout side wages like Box of Rocks, paying 50 to 1, Bottom of the Class, paying 200 to 1, and Rock Bottom, paying 500 to 1.
    https://ckan.obis.org/user/dustgsitconhand1982
    Know the rules of the game and play by them It’s not just about playing the game, it’s about knowing its rules. You can’t win at a game if you don’t know how to play it. Once you sit down at a table to roll the dice or pull up a chair to play blackjack,… Know the rules of the game and play by them It’s not just about playing the game, it’s about knowing… Know the rules of the game and play by them It’s not just about playing the game, it’s about knowing… Know the rules of the game and play by them It’s not just about playing the game, it’s about knowing its rules. You can’t win at a game if you don’t know how to play it. Once you sit down at a table to roll the dice or pull up a chair to play blackjack,…

  668. try

    Attractive section of content. I simply stumbled upon your web site and in accession capital to claim that I acquire in fact loved account your blog posts. Anyway I’ll be subscribing for your augment or even I success you get right of entry to constantly rapidly.

  892. situs online judi terbaik slot

    I’m impressed, I must say. Really hardly ever do I encounter a weblog that’s both educative and entertaining, and let me let you know, you’ve got hit the nail on the head. Your concept is excellent; the issue is something that not enough people are speaking intelligently about. I’m very completely happy that I stumbled throughout this in my search for one thing relating to this.

Leave a Reply

Your email address will not be published. Required fields are marked *

Eu Ai act
First Rules of the EU AI Act Come into Effect: What Does it Mean?
Tsaaro Consulting

First Rules of the EU AI Act Come into Effect: What Does it Mean?

The evolving digital landscape in the 21st century have placed a challenge for governments and organizations as they attempt to …

•
March 7, 2025
Digital Personal Data Protection (DPDP) Act
Exemptions Under the Digital Personal Data Protection (DPDP) Act, 2023  
Tsaaro Consulting

Exemptions Under the Digital Personal Data Protection (DPDP) Act, 2023  

Introduction  The Digital Personal Data Protection (DPDP) Act, 2023, and the Digital Personal Data Protection Rules, 2025 establish a comprehensive …

•
February 27, 2025
cybersecurity,
WHAT DRIVES CYBERSECURITY: A COMPREHENSIVE OVERVIEW 
Tsaaro Consulting

WHAT DRIVES CYBERSECURITY: A COMPREHENSIVE OVERVIEW 

In today’s interconnected world, cybersecurity plays a crucial role in protecting our digital lives. From protecting personal data to safeguarding …

•
February 21, 2025
Transfer Impact Assessments
Understand Transfer Impact Assessments: Insights from CNIL’s Practical Guide 
Tsaaro Consulting

Understand Transfer Impact Assessments: Insights from CNIL’s Practical Guide 

Introduction  A Transfer Impact Assessment (TIA) is a critical evaluation conducted under the General Data Protection Regulation (GDPR) to assess …

•
February 20, 2025
Draft DPDP Rules
The DPDP Act, 2023 and the Draft DPDP Rules, 2025: What Do They Mean for India’s AI Start-Ups?
Tsaaro Consulting

The DPDP Act, 2023 and the Draft DPDP Rules, 2025: What Do They Mean for India’s AI Start-Ups?

Introduction The Digital Personal Data Protection Act (DPDPA), 2023 and the Draft DPDP Rules, 2025 have ushered in a new …

•
February 12, 2025
Recent Comments

SHARE THIS POST

Would you like to read regular updates from Tsaaro.
Subscribe to our newsletter

Our Latest Blogs

Read what the latest hapennings in the cyber world are and learn what the
experts have to say about them

© 2024 Tsaaro Consulting. All rights reserved.
Linkedin Instagram Youtube

About Tsaaro

Resources

Other Links

Tsaaro Netherlands Office

Regus Schiphol Rijk Beech Avenue 54-62, Het Poortgebouw, Amsterdam, 1119 PW, Netherlands

Tsaaro Pune Office

Tech Centre, Rajiv Gandhi Infotech Park, Hinjewadi, Pune, Maharashtra

Tsaaro Noida Office

302, Tower C, ATS Bouquet, Noida Sector – 132, Uttar Pradesh, India

Tsaaro Bengaluru Office I

Manyata, Embassy Business Park, Outer Ring Road, Bengaluru, Karnataka

Tsaaro Bengaluru Office II

Second State, CMH Road, Indiranagar, Bengaluru, Karnataka

Call Our Experts:

+91 95577 22103

small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png

We’d love to help your organization achieve your Data Protection goals!

Schedule a complimentary consultation with our Team of Experts.