In the first year since its adoption, the General Data Protection Regulation (GDPR) has caused widespread panic, much of which is due to its slightly impenetrable drafting. A proliferation of misinformation has resulted in many businesses and industries addressing data privacy with a nearly-paralyzing level of caution. This article explores the impact of the GDPR on the e-discovery industry and demystifies some of the less-discussed provisions and exemptions.

When Does the GDPR Apply?

On its surface, the GDPR appears to have a broad reach: It applies to all processing of personal data where the data forms part of a filing system. As such, it may appear that the GDPR applies to all activities typically undertaken in an e-discovery project (“processing”) and to almost every circumstance where information about an individual exists (“personal data”).