The much discussed and long-awaited General Data Protection Regulation (“GDPR”) applies from today, May 25, 2018.  It will update and harmonize data protection laws across the EU, and sets out comprehensive rules in relation to personal data handling, as well as the rights of individuals over their personal data.

It is unclear how aggressively the data protection authorities (“DPAs”) will seek to be in the near future when it comes to using their new powers under the GDPR, and how quickly investigations will get underway, and fines imposed.  Many DPAs have suggested they are simply not ready to carry out the extra responsibilities given to them, which may lead to an ‘informal grace period’ for many companies who themselves have struggled to ensure they are fully GDPR-compliant by today.

Information Commissioner for the UK, Elizabeth Denham, stressed two days agothat becoming compliant is “an evolutionary process for organisations” and that “organisations must continue to identify and address emerging privacy and security risks in the weeks, months and years beyond 2018.”  These echo sentiments from a blog post she wrote in December 2017, in which she also set out that if companies can demonstrate that they “have the appropriate systems and thinking in place” then they will “find the ICO to be a proactive and pragmatic regulator aware of business needs and the real world.”