GDPR

A new survey sponsored by McDermott Will & Emery and conducted by the Ponemon Institute found that 40 percent of nearly 1,000 U.S. and European companies polled do not expect to meet General Data Protection Regulation (GDPR) compliance requirements by May 25.

Companies have struggled over the last few years to figure out even what GDPR compliance is. Forty-seven percent of those polled said they did not know where to begin their path to compliance.

Despite the high levels of anxiety that companies seem to feel around GDPR preparedness, especially given the regulation's steep fines for noncompliance, McDermott partner Mark Schreiber finds the number of companies who do not believe they will be prepared for GDPR compliance by the deadline “unsurprising.”

“What we're beginning to realize is that May 25 is not a stopping point. It's in some respects just a beginning,” Schreiber said. The race toward GDPR compliance, Schreiber said, “is going to be more like a marathon than a 100-yard dash.”

Although many companies have been making steady progress toward GDPR compliance for the last couple years, Schreiber said some others simply miscalculated the intricacies of the new regulation. “There are a lot of others who didn't quite appreciate the complexity and demands of what GDPR would take,” he noted.

In Schreiber's more than 20 years working in data privacy, the GDPR may be the most complicated regulatory shift he's seen to date. “It has innumerable pieces to it that are just beginning to be understood,” he said.

While Schreiber noted that the May 25 deadline for GDPR compliance is important, companies are increasingly aware that compliance isn't a goal you meet, but an ongoing process. “These obligations are going to go on for years with a number of new adjustments and modulations, further investment and compliance. It's not a one-stop, one-point-in-time obligation,” he said.

The study found that financial services, technology and energy sector companies lead the pack of those who planned to be compliant before the May 25 date, with about 60 percent of companies in each industry reporting likely compliance by the effect date. Companies in less highly regulated spaces, such as retail and manufacturing, were less likely to be compliant by the deadline.

Size also factored into a company's potential GDPR preparedness. Midsized companies, between 5,000 and 75,000 employees, were generally far more confident in their GDPR preparedness than either small companies or large companies.

Schreiber explained that both small and large companies face different kinds of challenges to GDPR preparedness. “If you're very small, you probably don't have the resources,” he noted, adding that large organizations conversely are tasked with trying to cover GDPR compliance across a huge set of different business functions.

For companies of all sizes, however, Schreiber sees a long road ahead for GDPR compliance, far beyond May 25. “It's literally going to create an entirely new regime. It'll have good points, it'll have struggles, but it's really demanding, and I think that's what everyone is learning,” he said.