How Many Companies Have Updated Their Privacy Policy for GDPR?

The deluge of privacy policy update emails caused by GDPR has been a somewhat unexpected consequence of Europe’s new data privacy and protection law. Especially for those in the United States who do not squarely fall within the protections offered by the law. There has been a lot of media coverage about it, but there really hasn’t been a lot of data in these stories on how many companies have been issuing them.

It would be hard to track the number of emails going out unless we were a member of all of these services. So we did some easier research here at Clarip. We set out to determine the number of companies that were updating their privacy policy online.

We looked at just over 1,000 companies on Monday including the Fortune 500 as well as a number of large tech startups, health organizations (pharma, health insurance, etc.) law firms, hotels and more to get a great cross section of companies to draw data from on their privacy policies. And then we started looking at when they were updated.

A number of companies didn’t date their privacy policy or didn’t have a privacy policy. But there were still a substantial number to pull data from:

91 of the 1,000+ companies updated their privacy policy in May 2018 (as of Monday). As you can see from the below chart, it is a massive increase in the number that typically update their policy – easily over 500% once you calculate the procrastinating companies which sent out their new privacy disclosure in the last week.

You can also see that once we add in the privacy policies that were updated this week, that there will be more privacy policies from the five months of 2018 then there are from all of 2017.

However, the above chart still suggests that there are plenty of privacy disclosures to come. More than 40% of businesses haven’t updated their privacy statement in the last year.

Fortune 500

Almost 10% of the Fortune 500 updated their privacy policy this month according to our research (last update on Monday – updated stats coming soon).

Our count is based on the 2017 Fortune 500 list because the 2018 list wasn’t out until after we started tracking the updates. It should only impact a handful of companies due to M&A activities, bankruptcies and new companies. We expect the overall impact to be relatively minor if the 2018 companies were swapped in for the 2017 companies.

US Tech/Startup Unicorns

It should come as no surprise that this sector had the largest number of privacy policy updates in May 2018.

For those wondering how we compiled the list, we took a list of “startups” valued at more than $1 billion and filtered for those based in the United States. We dropped the last few with the lowest valuations off the list so that we had an even 100 to compare to the other industry segments that we gathered. The list does not include any publicly traded companies.

Law Firms

When we started looking at the dates on privacy policies last week, law firms were some of the worst offenders. There were a number of privacy policies that had not been updated in years and they were also the lowest in terms of the number that had updated their policy in May 2018. But that started changing at the end of last week. A few of the firms with older policies posted their new disclosures and they went from one the lowest industry segment (among the ones that we looked at) to one of the highest.

Our count is based on the AMLAW 100 list from 2017.

Sports

NFL.com, NBA.com, MLB.com and the PGATour.com all updated their privacy policies this month. Did you notice who is left off this list? The National Hockey League.

Hotels

The travel industry has been one of the industries in the United States that is frequently mentioned in media coverage of the extraterritorial impact of the GDPR, so it should come as no surprise that it had one of the biggest rates of updated privacy policies in 2018. Almost 50% of the hotel companies updated their privacy disclosure in 2018. If you take into account that many of the hotels own several different large brands, the rate is even higher if you start counting the individual brands.

Please keep an eye out for our updated data as we intend to update our data over the weekend so that we capture all of the last minute privacy policy updates through #GDPRday!

Discover the Benefits of Privacy Management Software with Clarip

The Clarip data privacy software and team are available to help improve privacy and trust at your organization. Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo or speak to a member of the Clarip team.

If you are working towards GDPR compliance, try our modular GDPR software. Start with our automated GDPR data mapping software, enhance your privacy program with DPIA software, and meet ePrivacy requirements with the cookie consent manager.

If CCPA compliance in 2020 is on your radar, ask us about our California Consumer Privacy Act software. Improve efficiency of responses to data subject access requests with our DSAR Portal, or provide the right to opt out of the sale of personal information with our consent software.

Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo and speak to a member of the Clarip team.