The industry has a false sense of security around compliance – and most companies lack the data expertise they need, a report from law firm Osborne Clarke has suggested.