About two years and several million dollars in, Meera Patel, assistant general counsel for regulatory affairs at Cardinal Health Inc., says her Dublin, Ohio-based company is “as ready as we can be” for the May deadline of Europe’s new and expanded privacy law. Patel concedes, though, that the law still has its challenges.

“In general for a U.S. company,” Patel says, “just the concept of these regulations is very difficult.”