  The EU General Data Protection Regulation (GDPR), enforced from 25th May
2018, aims to reform how organisations view and control the personal data of
private EU citizens. The scope of GDPR is somewhat unprecedented: it regulates
every aspect of personal data handling, includes hefty potential penalties for
non-compliance, and can prosecute any company in the world that processes EU
citizens' data. In this paper, we look behind the scenes to investigate the
real challenges faced by organisations in engaging with the GDPR. This
considers issues in working with the regulation, the implementation process,
and how compliance is verified. Our research approach relies on literature but,
more importantly, draws on detailed interviews with several organisations. Key
findings include the fact that large organisations generally found GDPR
compliance to be reasonable and doable. The same was found for small-to-medium
organisations (SMEs/SMBs) that were highly security-oriented. SMEs with less
focus on data protection struggled to make what they felt was a satisfactory
attempt at compliance. The main issues faced in their compliance attempts
emerged from: the sheer breadth of the regulation; questions around how to
enact the qualitative recommendations of the regulation; and the need to map
out the entirety of their complex data networks.
