GDPR Is Eleven Months Out, and Yes, It Probably Means You

The conversation now happens weekly, and it always opens with the same question, so let us open there too. We are an American university, hospital, nonprofit, company. Surely Europe’s new privacy regulation is not our problem?

Check your funnel before you answer. The EU students in your applicant pool, browsing your program pages from Lyon. The EU donors on your advancement list. The EU alumni in your newsletter segments. The EU visitors your analytics quietly log on every page.

The General Data Protection Regulation, adopted last spring and enforceable beginning May 25, 2018, was written to follow the data rather than the corporate registration. It applies to organizations anywhere that offer goods or services to people in the EU, or watch their behavior. Its penalty schedule runs up to four percent of global revenue. Numbers designed to reach the board agenda, so that the question gets asked seriously. Treat this as a data diet, not a legal costume. Collect less, explain more, and most of the regulation takes care of itself.

For most institutions in this audience, the answer to ‘does it mean us?’ is yes. At least somewhere in the site. Eleven months is a comfortable runway for the organizations that start now. It is a genuine emergency for the ones that discover the question next spring. This post is the sequencing.

Start with the inventory, because everything depends on it

The founding exercise, and the one that always surprises. A census of what personal data your web properties actually collect, where it flows, and who touches it.

Walk the site, the same inventory habit our security coverage keeps prescribing, aimed at a different layer, and list every form. Applications. Event registrations. Newsletter signups. Contact forms. Donation pages. Surveys. The gated-content downloads marketing added in 2015.

Then the invisible layer, which is where the surprises live. The analytics collecting IP addresses and behavior traces on every page. The marketing pixels and remarketing tags. The tag-governance census pays off here directly. The session-recording tools. The embedded third parties, each with their own collection habits. The CRM hookups moving form data onward.

The finding, in every inventory we have run this year: organizations collect more personal data than any single person in them knows. Not through strategy but through accretion, tool by tool and campaign by campaign.

That buildup is precisely what the regulation forces into view. The inventory converts an unanswerable compliance question, ‘are we compliant?’, into a workable project list. ‘Here are our collection points, flows, and vendors.’ It is also the same exercise a mature measurement practice wanted anyway, which is a theme this post will return to.

The work between now and May, sequenced

• Lawful bases, set and recorded. For each processing activity in the inventory, the regulation asks one question: on what basis? Consent, contract, or legitimate interest are the usual grounds. This is judgment work done with counsel, and it forces useful clarity. Much routine processing rests comfortably on non-consent bases. Knowing which is which prevents both under- and over-asking.

• Processor agreements, reviewed vendor by vendor. Every tool in the inventory that touches personal data needs data-processing terms that meet the regulation’s rules. The email platform, the analytics, the CRM. The form processors. Us, your agency. The major vendors are shipping their updated agreements now. The review is tedious, easy to split up, and entirely schedulable this fall.

• Consent mechanics built for a regulator, not a checkbox. Where consent is the basis, it must be specific, informed, and freely given. And as easy to withdraw as to grant. That retires the pre-ticked box, the buried clause, and the consent-by-continuing banner. This is interface work as much as legal work. Doing it honestly is a user-experience question we will take up properly in its own piece. Asking clearly, in context, for things the user understands.

• Rights plumbing and breach readiness. A workable path for access, correction, and deletion requests. Workable meaning someone owns it and it has been rehearsed. And a breach-response plan meeting the regulation’s notification clock. That folds directly into the incident-response practice our security coverage has already installed.

What we are doing ourselves, disclosed

An agency is a processor in this regulation’s vocabulary, and advice that exempts its author deserves suspicion. So, the disclosure. We are running the same sequence on our own house.

For clients whose properties we build or host, our data-processing agreements need updating too, and clients should expect that paperwork to be part of the process.

Our internal inventory surfaced the same accretion the client inventories do. Analytics configurations logging more than reporting ever used. Form data flowing to tools adopted for one campaign and never retired. The pruning has been clarifying in exactly the way the sequencing predicts. Collection justified by use turns out to be a fraction of collection accumulated by default.

And our project templates are absorbing the practice for good. New builds now start from a data-collection worksheet. What does this form gather, on what basis, flowing where, kept how long. The same way they start from the accessibility and performance budgets.

The regulation’s deepest lesson is that these are all the same kind of artifact. Constraints declared before build, verified at launch, audited on a calendar. Vendors and agencies who cannot show you their own homework this year are selling compliance they have not practiced. Ask for the worksheet.

The strategic read, which we would stake

Now the paragraph that belongs in the planning meeting rather than the compliance file.

It is tempting for American organizations to treat this regulation as a European quirk to be minimally appeased. We think that reading fails the direction-of-travel test we apply to everything. The trendline runs one way.

User expectations about data handling are hardening. Every breach headline moves them. The browser vendors are building privacy enforcement into the platform itself. Watch the measurement space this fall. And legislatures elsewhere are studying the template, as legislatures do.

Privacy is moving from policy-page boilerplate to operating practice. The organizations that build consent-respecting collection and measurement now are not paying a European tax. They are building the plumbing the next decade will require everywhere, on a schedule they chose.

There is also the plainer point, the one we keep arriving at from the user’s chair. Collect only what you need. Say clearly what you do with it. Honor the person’s choices. That is simply what trustworthy institutions do, and trust is the asset every institution in this readership is actually in the business of.

The regulation, squinted at correctly, is a forcing function for hygiene you wanted. Begin with the inventory. Everything else depends on it, and May will arrive on schedule either way.