Despite the yearslong build up to the EU's General Data Protection Regulation (GDPR), which came into force on May 25, many organizations are still behind in their compliance efforts. And while much attention has been paid to corporations' compliance shortcomings, a recent Wolters Kluwer survey found that law firms are also lagging in meeting GDPR mandates.

Conducted among 74 medium (26-100 staff members) to large (100-plus) law firms, the survey found that only 47 percent of law firms said they were “fully prepared” to meet the GDPR's requirements. While 16 percent said they were “somewhat prepared,” more than a third, 37 percent, said they have not prepared specifically for the GDPR at all.

Barry Ader, vice president of product management and marketing at Wolters Kluwer, noted that part of the reason why many law firms were unprepared for GDPR was because they thought there would be an extension to the deadline. “Many of the law firms kind of half expected that there would be a delay, and they wouldn't have had to solve the problem by May 25,” he said.

However, Ader noted that the lack of preparation was also a sign that “law firms just don't have the necessary skills, people, and budget to figure out how to handle GDPR.”

Indeed, law firms are in a unique situation when it comes to the GDPR, given that many not only have to ensure their own firm's compliance while also managing and directing their clients' GDPR compliance efforts. Such “double duty” is forcing some firms to staff up and overextend their attorneys. Yet even with added staff and hours, firms can find it challenging to meet GDPR demands.

London-based Squire Patton Boggs partner Ann LaFrance, for example, told The American Lawyer that hiring cannot keep up with the wide-ranging compliance needs of their clients. “It still isn't enough, and there isn't enough experience out there.”

Still, while firms may have a lot of GDPR preparation to do, 60 percent had already assigned a point person, consultant or team to spearhead GDPR compliance efforts, while 72 percent were investing in cybersecurity. What's more, 43 percent assigned a data protection officer (DPO), though they were not required to under the regulation. Such a mandate only applies to companies classified as “data controllers” who determine the purposes for, and the means of, processing EU personal data.

One area where many firms' GDPR preparations lagged behind is with employee training. The survey found that only 43 percent of law firms conducted security and privacy training annually, while 24 percent had done training in the past three years. An additional 15 percent said that while they did not currently train employees, they were planning to do so in the near future. Seventeen percent did not and had no plans to train at all.

Though the survey did not ask if the training was GDPR-related, Ader noted that “the only way the training would have been considered GDPR is if it happened in the past year. Only 43 percent are doing it annually, so I would say for 43 percent, it is possible that GDPR was included.”