Three days is a short turnaround-too short, according to one legal expert. 72 hours?!? ThatвЂ™s the time you have to notify EU citizens should their data be compromised. Tools that perform data profiling and mapping will go a long way toward accomplishing that, but companies that have haphazard data management practices in place could face greater expense than they anticipate.ДЈ. The sheer effort of discovering the personally identifiable (PII) data you have and where it is stored could be very great indeed. вЂњMany firms donвЂ™t know what data they have, why they have it, or whether it should be regarded as personal data,вЂќ says Duncan Brown, associate vice president forВ European infrastructure and security at IDC. and the EU suggests that EU regulators will be able to fine U.S. Moreover, ongoing enforcement cooperation under international law between the U.S. companies have EU subsidiaries as this is required to operate in the EU market. And if you think that the long arm of EU enforcement canвЂ™t reach across the Atlantic, think again. Your company may be headquartered in Columbus, Ohio, but if you retain email addresses of German citizens, you must comply, just as if your company were based in Cologne. Be very careful with that assumption, even if your company does not have a subsidiary in the EU. Ready, willing, or not, the path to compliance must be taken, traversing unexplored territory that could contain unpleasant-and costly-surprises. On the bright side, 23 percent of survey respondents said they have begun implementation, 11 percent said they are вЂњwell underway,вЂќ and 4 percent claimed to be fully compliant with GDPR. The EU describes GDPR as вЂњthe most important change in data privacy regulation in 20 years.вЂќ But you would never know it, judging from the responses to a recent survey, Privacy and the EU GDPR, conductedВ by Dimensional Research and TrustArc, which found that 61 percent of companies have not started the process of GDPR implementation. Totals could theoretically reach billions of euros for the largest companies. Enforcement will carry stiff penalties for noncompliance: the greater of в‚¬20 million or 4 percent of global annual revenue. For most, the trick will be to steer clear of penalties, while avoiding unpredictable expenses.Д«ased on the concept that people вЂњownвЂќ data about them, GDPR mandates that businesses, governments, utilities, and charities handle people's data with care, meaning they must use it only with the explicit consent of its owners, provide it to them upon request, and inform them promptly should it be compromised.

With enforcement set to begin in May 2018, organizations worldwide are scrambling to comply with the European UnionвЂ™s General Data Protection Regulation ( GDPR).

Breach and clear deadline save editor