As a new set of privacy and data protection laws go into effect in the European Union (EU) in 2018, U.S. companies with an EU web presence need to start considering the impact that the EU’s General Data Protection Regulation (GDPR) will have on their business operations, including how they collect, store and process data. The GDPR introduces a host of new obligations and restrictions for companies and the information they collect and maintain, as well as increased liability if data is not maintained and transmitted in accordance with the new regulations. The heightened scrutiny will come not just from the data protection regulators in each EU country, but from private lawsuits and complaints by and on behalf of individuals and privacy watchdog organizations.
An analysis of all of the new obligations and restrictions imposed by the GDPR is beyond the scope of this article, which will focus on answering key questions companies have about the consequences of noncompliance and the unique enforcement mechanisms built in to the GDPR. In short, we will answer the who, what, where, when, how and why of GDPR enforcement.
