The Subtle, Long-Term GDPR Goals—And How To Meet Them

With a little bit of hindsight on GDPR's enforcement date of 25 May 2018, we can now see a real pattern: most organisations developed their compliance programs in two phases, one before and one after the "go-live".

Why is that important? Because the first phase was deadline-oriented and had clearer metrics of success, while the second phase has proven to have subtler aims and to be harder to carry out properly.

BEFORE AND AFTER

Leading up to 25 May, GDPR efforts were mainly tactical, oriented towards meeting a hard deadline rather than on developing a long-term strategy. Most organisations focused on "paper-based" compliance and on establishing privacy foundations, conducting a GDPR gap assessment and then developing a remediation action plan to ensure their readiness (as far as possible) by 25 May. These action plans mainly covered things like new policies and procedures, how to keep records of processing activities (article 30), updates to contracts and