The General Data Protection Regulation (GDPR) goes into effect in roughly one year, yet many multi-national companies are still behind in preparing for compliance. This sweeping regulation requires organizations to meet stringent data protection requirements over personal data of EU citizens and for the first time, also impacts companies that are based outside of Europe. GDPR defines personal data as any information related to an individual, which can include things like physical address, email address, IP addresses, age, gender, GPS location, health information, search queries, items purchased, etc.

Many companies today freely harvest and commercialize this information. GDPR preparedness involves cross-departmental work involving privacy, security, legal, IT, compliance, outside counsel and other stakeholders. With just a year remaining to put compliance programs in place, corporations need actionable and efficient strategies to effectively prepare.

Feedback from in-house counsel and information governance (IG) professionals around GDPR readiness and urgency has been mixed. In some cases, GDPR has been rated low on the list of concerns that are expected to impact the legal department in the next one to three years. Conversely, respondents in a recent advice from counsel study indicated that GDPR is top of mind for corporations with European operations, customers or partners. The reality of the penalties and litigation risks that may result from noncompliance are serious, and the amount of time corporations have left to prepare is hardly enough for the scope of work that will need to be completed.