Businesses around the globe continue to grapple with the requirements of the EU's General Data Protection Regulation (GDPR), which went into effect May 25. Law firms are no exception—and that's true even if they have no offices overseas.

Pennsylvania firm leaders and legal technology professionals said GDPR compliance should be a priority for most firms, as it applies to any business that handles data belonging to EU citizens. For firms that are behind in getting prepared, they said, it's better late than never.

A recent survey by Wolters Kluwer found that only 47 percent of law firms were ready to meet GDPR requirements, and 37 percent said they have not prepared specifically for the new regulations at all. How the rules will be enforced is yet to be seen, but the consequences of noncompliance are major: potentially, a fine of 20 million euros or 4 percent of the company's revenue, whichever is higher.

And then there's the matter of why the regulations were put in place to begin with—the threat of a data breach, a disaster for any firm, especially one that has run afoul of privacy regulations in its jurisdiction.

Data breaches are the greatest risk for law firm brands, especially those with a privacy practice, Benjamin Ness, senior manager of marketing operations and technology at Dechert, said at a recent Legal Marketing Association event in Philadelphia.

What Now?

Ness spoke at the June 13 event alongside Doug Ladendorf, the marketing database and CRM manager at Mayer Brown, and Helena Lawrence, a marketing manager for Orrick, Herrington & Sutcliffe's cyber, privacy and data innovation practice. To firms that have not yet started their GDPR compliance preparations, they said, ”don't panic.”

Lawrence said to start, firms should figure out what data they have, and what data needs to be GDPR compliant. They should also work with privacy lawyers to determine when and how to ask for consent regarding data use, what to do if there is a breach and what to do if a person asks for their data to be wiped from the firm's systems, Ladendorf said. Firms should be checking with their vendors about compliance too, Ness said.

And that's not just for firms like Dechert, Mayer Brown and Orrick, which have offices in the EU.

“Even for small firms, I think it's really unlikely they're going to completely escape some kind of GDPR analysis,” said Phil Yannella, co-leader of the cybersecurity practice at Ballard Spahr.

Ballard Spahr has no offices outside the U.S., but Yannella said his firm still did an assessment to see whether it falls into the category of “data controller” or “data processor” for any information it holds. Controllers have a more extensive list of requirements under GDPR, while businesses classified as data processors face different requirements.

“For a firm like ours, a lot of what we do could fall into the processing bucket,” Yannella said. For example, “if we have litigation that involves an EU-based company … the GDPR would apply.”

Ajay Raju, chairman of Philadelphia-based regional firm Dilworth Paxson, said GDPR came to his attention thanks to his chief information officer, Ali Sethi. The firm has been making modifications to its data policies and procedures, and sending notices to clients and other necessary parties. Raju said he carried over Sethi's advice to other businesses he is involved in as well, such as his venture capital fund.

Even though the likelihood of being caught in violation of GDPR is lower for U.S. regional firms, “that almost makes it riskier for us,” Raju said. “We're taking it very seriously. While other companies have more exposure, the consequences are the same.”

Not So New

Ballard Spahr has been working to meet all the requirements of the GDPR, Yannella said, including documentation and communication with clients, as well as educating lawyers within the firm. But a lot of that is just an extension of previous firm policies.

“A lot of what the GDPR requires isn't new. Law firms should have been thinking about how they process EU data, particularly in the litigation context, for years,” Yannella said. “They should have been thinking about information security for a long time.”

Still, preparation has called for collaboration between risk management, marketing, IT and information security teams, he said.

Raju said Dilworth Paxson's GDPR preparations have been no different than those at larger firms, noting that “it's such a wide-sweeping and broad regulation that you have to take extra precautions.”

As a result, he said, it may be a struggle for smaller firms, without in-house technologists and marketing staff, to keep up with the requirements.

“The cost of compliance for smaller firms is enormous,” he said. “A lot of people are probably choosing to do nothing.”