On May 25, 2018, the European Union’s General Data Protection Regulation took effect, sweeping aside a patchwork of laws governing data protection and breach notification in individual EU member states.

GDPR was heralded by clamorous alarms from lawyers and consultants, warning clients that the failure to comply with the law could have massive ramifications for their businesses. The threat of fines up to the greater of €20 million or 2% of worldwide annual revenue was picked up by mainstream publications and echoed throughout boardrooms and conference centers in the United States.