When Alexander “Sandy” Bilus, a cybersecurity and privacy attorney with Saul Ewing Arnstein & Lehr, was speaking to representatives from different colleges earlier this month, one of them asked if complying with the European Union’s General Data Protection Regulation is worth the high cost of compliance.

The short answer is yes.