Local Privacy Laws Not Ready for Prime Time: Enterprises that process or store the personal information of EU citizens will also need to heed EU member states' local privacy laws. GDPR has also allowed local data protection authorities to individually interpret some aspects of the law and add requirements. However, a lot of local privacy laws are not yet set in stone. “There are still member states lagging behind and working behind where they're supposed to have prepared for, so for once we can say it's not just organizations who are behind, it's also the member states,” said Bird & Bird partner Gabriel Voisin.

Imitation may be the sincerest form of flattery, but sometimes it's hard to tell imitation from sheer coincidence. Earlier this month, the Australian Competition and Consumer Commission released a series of recommendations echoing several core tenants of the European Union's General Data Protection Regulation (GDPR).

Australia isn't the only world player doing a GDPR cover. Back in November, Canada passed the Personal Information Protection and Electronic Documents Act offering similar privacy protections to those featured in the European Union. California's forthcoming California Consumer Privacy Act will even bring a taste of those principles stateside.

So is the GDPR taking over the world? The cultural differences that have historically defined each individual country's approach to privacy make it difficult to tell whether the European Union's landmark privacy legislation has set a new bar or simply overlaps a number of security best practices.

Still, Commerce is one of the few areas where it's easy to feel the guiding hand of the GDPR—and it can help to explain why lawyers in the U.S. won't be saying goodbye to the GDPR any time soon.

“People are really concerned about complying with [the GDPR]. It's the new hot topic, and it's just so comprehensive and there are so many provisions to it that it's still on the forefront of everyone's mind because there's so many aspects of compliance,” Elizabeth Dill, a partner and member of the data privacy and cybersecurity practice at Lewis Brisbois, said.

The firm is often fielding questions from corporate clients that fall somewhere along the lines of: “We don't technically have to do this, but wouldn't it just be easier to become GDPR compliant now?”

The answer is always yes. Companies, especially the bigger ones with lots of moving parts, can't change their data processing methods or security programs overnight. Christopher Ballod, a partner specializing in data privacy and cyber security at Lewis Brisbois, often advises clients to consider where they think privacy laws in the United States will stand in two years time.

For those purposes, California might be the best weather vane around. The state was at the forefront of the data breach notification laws that were eventually picked up in other states. While its incoming data privacy law is not an identical twin to the GDPR, it does include many of the same privacy protections.

“We spend a lot of time even with American companies who have little contact with Europe at this point getting them GDPR ready because they want to do business and continue to do business in California, or because they have plans to do business or market to European customers,” Ballod said.

Even if those clients have no designs on Europe whatsoever, they are often engaging in partnerships with larger domestic companies who are already compliant and expect the same of their business associates.

U.S. laws have typically avoided confronting privacy directly, instead focusing on breach notification standards or preventing identity theft. Still, if enough of the country's businesses begin tailoring their security and data infrastructure towards E.U. standards, it might make sense for any emerging national policies to begin leaning in the same direction.

“I think law is actually going to reflect reality as opposed to reality reflecting law,” Ballod said.