Over the last few weeks, we all have been inundated with emails from merchants and websites alerting us to privacy policy changes or asking for consent to use our personal information.  Those merchants and websites are trying to comply with the European Union’s General Data Protection Regulation, which took effect on May 25, 2018.  Regardless of what steps your company has taken toward GDPR compliance, May 25 represents not the finish line, but the starting point.

If your company has taken no steps toward GDPR compliance—or if you’re not sure whether GDPR applies to you—it’s not too late.  EU regulators are expecting U.S. companies to show a good faith effort toward compliance, and the first step is determining whether your company is subject to GDPR.  If your company does any of the following, then GDPR applies: (1) markets goods or services in the EU; (2) has employees or business locations in the EU; or (3) monitors the behavior of individuals in the EU.  If GDPR applies to your company, then you face fines as high as $21 million or 4% of annual gross revenues for non-compliance.  Therefore, if you have taken no steps to comply, there is strong incentive to do so as soon as possible.

If your company has been working on its GDPR compliance program, your work is not finished; GDPR creates continuing obligations, including responding to requests from data subjects and conducting data protection impact assessments.  Additionally, the new European Data Protection Board has already issued new guidance interpreting GDPR.  Organizations must therefore remain conscious of GDPR as their business changes and technology evolves, and new guidance from regulators, initial enforcement actions, and court decisions may drastically change how GDPR affects your business.