Due to the GDPR’s extraterritorial scope and major changes in comparison to current laws and regulations, breaches within Hirslanden have been analysed and proper implementation and management of data privacy governance have been enforced with the assistance of external advisors in order to manage operational and reputational risks and to avoid potential fines for non-compliance.