This article is based on survey findings and industry commentary published around the May 2018 GDPR enforcement deadline. The original source is devops.com. Statistics cited reflect the state of industry readiness at that time.
The Compliance Gap: What the Surveys Found
When the EU’s General Data Protection Regulation (GDPR) took effect on 25 May 2018, most organizations were not fully compliant. Multiple independent surveys, conducted in the months before the deadline, painted a consistent picture: awareness was high, but concrete readiness was not.
The Cloud Security Alliance (CSA) and Netskope released survey results drawn from more than 1,000 respondents. Key findings included:
- 83 percent of respondents said their organization was not very prepared for GDPR.
- 85 percent had taken some steps toward compliance, but only 31 percent had a well-defined plan for meeting GDPR provisions.
A separate survey of 700 network security and IT professionals by Enterprise Strategy Group (ESG) found:
- Only 11 percent of firms were completely ready ahead of the May 25 deadline.
- 33 percent said they were prepared to disclose data breaches within the GDPR-mandated 72-hour window.
- An additional 33 percent were mostly prepared, and 44 percent were somewhat prepared for breach disclosure requirements.
- While only 10 percent had made or planned major GDPR investments, 63 percent committed to incremental investments.
Analyst firm Varonis surveyed 500 IT security professionals across the United States, UK, France, and Germany in October 2017. Their findings showed:
- 60 percent of EU respondents and 50 percent of US respondents faced serious challenges before they could achieve GDPR compliance.
- Despite that, 70 percent of represented firms believed GDPR compliance would give them a competitive advantage.
Where Is the Data? The Fundamental Visibility Problem
A core reason organizations struggled with GDPR was a basic failure to understand where their data actually lives. Compliance with regulations like the right to erasure or data portability is impossible if you cannot locate and inventory personal data in the first place.
Varonis data highlighted the scale of this internal data governance problem:
- 21 percent of organizations’ electronic folders were open to all employees — with no access controls in place.
- 54 percent of surveyed organizations’ data was classified as stale — not actively used but still stored and potentially subject to GDPR obligations.
The shift to hybrid infrastructure — where data is spread across on-premises servers, private clouds, and public cloud providers — compounded the problem. Tracing the origin of customer data and determining whether it is subject to GDPR protection becomes significantly harder in a distributed environment.
“We live in a hybrid world in which data isn’t stored entirely on-premises or completely in the cloud. The hybrid model creates additional challenges and potential risk from a security and data governance standpoint. You can’t assume your data is safe in the cloud. If your cloud environment isn’t secure, your data won’t just be in danger of being exposed to your entire organization — it could be accessible to the world.”
— Ken Spinner, Vice President of Global Field Engineering, Varonis
Uncertainty About GDPR Scope Slowed Progress
Beyond data visibility, legal and regulatory uncertainty was a significant blocker. Key questions that remained unresolved ahead of enforcement included:
- Whether GDPR protections apply to EU citizens only, EU residents, or any individual physically present in EU territory at the time of data collection.
- How the EU would practically enforce fines against non-EU organisations that process EU personal data.
- Which specific technical and organisational measures would satisfy requirements like “data protection by design and by default.”
According to ESG data, fewer than one-third of surveyed organisations fully understood all of GDPR’s requirements. Legal departments were waiting for further regulatory guidance before greenlighting compliance projects — creating a bottleneck that delayed DevOps and engineering teams from doing the work they were already positioned to do.
The CSA/Netskope survey identified the three biggest compliance stumbling blocks:
- Right to erasure — cited by 53 percent of respondents as a major challenge.
- Data protection by design and by default — cited by 42 percent.
- Records of processing activities — cited by 39 percent.
The Stakes: GDPR Penalties
Non-compliance with GDPR carries significant financial penalties. Under the regulation, supervisory authorities can issue fines of up to 4 percent of an organisation’s annual global revenue or €20 million, whichever is higher, for the most serious violations. Lower-tier violations carry fines of up to 2 percent of annual global revenue or €10 million. The scale of potential fines made GDPR a board-level concern, not just an IT one.
Where DevOps Fits In the Compliance Picture
DevOps practices offer genuine capabilities for building and sustaining GDPR compliance — but only after legal and business stakeholders define what compliance actually requires for their specific context. The bottleneck in 2018 was not technical; it was organisational.
Once requirements are defined, DevOps teams can contribute in concrete ways:
- Shifting compliance left: Embedding data protection requirements into the design phase of new applications, rather than retrofitting them after deployment.
- Automated data discovery and classification: Using tooling to continuously scan and classify personal data across hybrid environments, reducing manual audit effort.
- Pipeline controls: Adding automated checks to CI/CD pipelines that flag code or infrastructure changes that could violate data protection policies before they reach production.
- Audit logging and monitoring: Implementing automated audit trails to support both internal governance and regulatory reporting requirements.
- Handling data subject requests at scale: Automating responses to rights requests (access, erasure, portability) — critical for large organisations with millions of data records.
“DevOps can assist companies in complying with regulations like GDPR by ensuring that key regulatory requirements are part of the initial design criteria, and taken into account when applications are updated. GDPR manual methods of enforcing data policy aren’t realistic solutions because large organisations could have millions of files. DevOps can support GDPR requests with processes and solutions that ensure personal data that falls under the new regulations is protected and used appropriately.”
— Ken Spinner, Vice President of Global Field Engineering, Varonis
Key Takeaways for DevOps and Engineering Teams
The 2018 GDPR experience highlighted a recurring pattern in compliance initiatives: technical teams are often ready and able to execute, but they are blocked by organisational, legal, or budget decisions made upstream. For DevOps engineers, the practical lessons are:
- You cannot protect data you cannot find. Data inventory and classification are prerequisites to any compliance programme, and automation is essential at scale.
- Hybrid environments require deliberate governance. Assuming cloud providers handle data security on your behalf is a compliance risk.
- Compliance is not a one-time project. GDPR requires ongoing processes — continuous monitoring, regular audits, and repeatable workflows for handling data subject requests.
- Cross-functional alignment is non-negotiable. Legal, security, product, and engineering teams must define requirements together. DevOps cannot automate what has not been defined.
GDPR enforcement has continued to evolve since 2018, with regulators issuing fines and guidance that have clarified many of the early ambiguities. Organisations building compliance programmes today have more precedent to draw on — but the fundamental challenge of data visibility and cross-team coordination remains.