There wasn't an actual show of hands during Legalweek New York's "GDPR & CCPA are Fueling High Demand for On-Point RegTech Solutions" session Tuesday, but the vast majority of the audience seemed to be well aware of the European Union's General Data Protection Regulation. Still, as rhetorical as the initial question may have been, it did serve as a solid jumping-off point for a freewheeling discussion privacy, compliance and —for the briefest of moments—Congress.

Here are four major takeaways from the discussion:

About This Whole Privacy Craze…

It's here to stay. According to Anju Khurana, a panelist and director and head of data privacy and protection at BNY Mellon, there are presently more than 100 jurisdictions with privacy laws. Some—like the GDPR—are even extra-territorial, meaning that they apply to companies based outside the country's sovereign borders. The U.S., meanwhile, presents its own complications since individual states are leading the privacy charge in the absence of an overarching federal law. Kenneth Rashbaum, a partner with Barton, advises clients not to wait for a national regulation before starting their compliance efforts. "Waiting for Congress is like waiting for Godot," he said.

 There's More That Unites Than Divides

So yes, there are many, many privacy laws that a single company may find itself having to balance, but the good news is that many of them share some common principles that more or less circle under the umbrella of data subject rights. Rashbaum said that clients typically don't want to know the ins and outs of each in particular law, instead preferring a concrete action plan for compliance. But what might such a plan look like? Rashbaum indicated that privacy policies are typically drafted towards common pillars found in each of the applicable laws, with appendixes built in to cover any outliers or particulars.

Compliance Is Not One and Done

Courtney Stout, chief privacy officer at S&P Global, framed compliance as an ongoing effort that requires constant evaluation. "I don't know that you can ever always be 100% compliant," she said. Complicating matters further can be the data subjects themselves. Stout noted that usually when people contact a business about how their data is collected or used, they may already be in an angry state of mind. "Individuals will often file a compliant with a regulator at the exact same time they notify you," Stout said.

It's Possible to Do Too Much Data Mapping

With all this talk of privacy laws, companies may feel the sudden and inexplicable urge to engage in some sort of preparation. Trust that instinct. Rashbaum urged organizations to implement a decision tree so that when a breach happens, getting the right people on the phone involves less frantic shuffling of the company directory. Putting together a data map—basically an outline of where all an organization's data is stored—is another step in the right direction if done right. Khurana said that data maps should be sure to correlate to specific individuals so that it's also easier to execute data subject access requests. However, if a company is of notable size, it may be worth it to determine which divisions are actually impacted by a given privacy law before roughing out a data map. "I think it should be surgical, I think it should be targeted and I think it should start once you know what your legal obligations are," said Tess Blair, a partner at Morgan, Lewis & Bockius.