The first ever global 'cost of a data breach' study reveals that Australia is the cheapest place to practise poor data security for business.

The Ponemon Institute in conjunction with PGP Corporation has announced the results of the first ever global study into the costs that are incurred by business following a data breach. It makes for good, or should that be bad, reading as far as Australia is concerned.

The research assessed the actual real-world cost of the activities undertaken following more than one hundred actual breach incidents which impacted upon organisations across 18 different industry sectors in Australia, France, Germany, the UK and the USA.

While globally the average cost of a data breach came to a bloody huge US $3.43 million for 2009, or US $142 per individual compromised customer record, the really interesting stuff starts happening when you look at the figures on a per country basis.

Those doing business in the USA were faced with by far and away the highest costs amongst the world powers analysed, with the average breach costing US $6.75 million courtesy of strict breach notification laws.

In Australia, France and the UK, where data breach notification laws have not yet been introduced, costs were all below the average. Dr. Larry Ponemon, chairman and founder of The Ponemon Institute, is certain that as notification laws are introduced across the rest of the world "other countries will follow the same pattern and costs will rise".

Jonathan Armstrong, a technology lawyer at Duane Morris, warns that with the UK Information Commissioner’s Office "toughening its stance on data protection, imposing hefty fines and scrutinising more and more organisations, it will be interesting to see how steeply UK costs rise in the future".

That is, in my opinion, a good thing for the UK and it's a bad thing for Australian business while it remains a cheap country to do insecure business in. Higher costs incurred when data is breached acts as a catalyst for improved security, and surely that has to be a good thing?

This story is available in full at ITWire.