1. Home
  2. |Insights
  3. |GDPR Compliance: The Beginning – Not the End

GDPR Compliance: The Beginning – Not the End

Client Alert | 2 min read | 05.25.18

Although the current focus of many companies regarding the EU General Data Protection Regulation (GDPR) is on the May 25, 2018 effective date, we see that date as the beginning, not the end, of implementing a global GDPR compliance program. First, the risk-based GDPR framework for privacy and data security is an ongoing compliance process, not a “one-and-done” activity. Second, the EU Member State Data Protection Authorities (DPAs), charged with enforcing GDPR compliance, are grappling with how best to approach the operational issues that arise as entities interpret and implement GDPR’s data protection principles. Third, we expect the issuance of additional guidance that will potentially impact a number of companies’ activities, including the interaction between GDPR and the not-yet-final EU ePrivacy Regulation for online data activities. As a result, we expect to see DPA interpretations of GDPR, including through enforcement activities, that will provide clearer compliance guidance.

Organizations that are beginning to or in the process of developing and implementing compliance programs should keep the following general principles in mind:

  • Don’t panic, but focus on high-risk priorities in the processing of personal data, which will depend on type of business operations, size of organization, territorial scope, etc.
  • GDPR compliance is a risk-based assessment rather than an exercise in complying with black and white rules. Because risk management must be tailored to the activities of each entity, reasonable GDPR compliance will vary from entity to entity. Avoid copying what another entity does with regard to GDPR or using a template approach to GDPR compliance.
  • Entities that are active in the online advertising, marketing, and communications space need to make sure that their risk management activities under GDPR maintain sufficient flexibility to account for the not-yet-released EU ePrivacy Regulation.
  • Successful completion of a GDPR compliance project requires:
    • Support of senior management as a top-level priority, who should be fully informed of potential risks of non-compliance and briefed regarding compliance efforts on an ongoing basis.
    • Involvement of legal, HR, finance, marketing, IT, and other key stakeholders in order to have a 360-degree view of the activities impacting the collection and processing of personal data.
    • A point person with overall responsibility for GDPR compliance, whether a formal data protection officer (DPO), to the extent required under GDPR, or another individual assigned enterprise-wide responsibility for data protection. 
  • GDPR compliance involves amending contracts, policies, and notices, but it is not a paper exercise. Most importantly, organizations should use GDPR compliance as the motivation to carefully assess all the ways in which personal data are handled and how the organization can adapt its existing processes and systems, and create awareness throughout the whole organization to change the approach towards personal data.

Crowell & Moring’s GDPR practice will continue to post alerts regarding key GDPR updates and guidance on our blog and conduct periodic webinars and live programs on GDPR implementation and enforcement developments. For more information, please see our GDPR overview.

Contacts

Insights

Client Alert | 5 min read | 12.12.25

Eleventh Circuit Hears Argument on False Claims Act Qui Tam Constitutionality

On the morning of December 12, 2025, the Eleventh Circuit heard argument in United States ex rel. Zafirov v. Florida Medical Associates, LLC, et al., No. 24-13581 (11th Cir. 2025). This case concerns the constitutionality of the False Claims Act (FCA) qui tam provisions and a groundbreaking September 2024 opinion in which the United States District Court for the Middle District of Florida held that the FCA’s qui tam provisions were unconstitutional under Article II. See United States ex rel. Zafirov v. Fla. Med. Assocs., LLC, 751 F. Supp. 3d 1293 (M.D. Fla. 2024). That decision, penned by District Judge Kathryn Kimball Mizelle, was the first success story for a legal theory that has been gaining steam ever since Justices Thomas, Barrett, and Kavanaugh indicated they would be willing to consider arguments about the constitutionality of the qui tam provisions in U.S. ex rel. Polansky v. Exec. Health Res., 599 U.S. 419 (2023). In her opinion, Judge Mizelle held (1) qui tam relators are officers of the U.S. who must be appointed under the Appointments Clause; and (2) historical practice treating qui tam and similar relators as less than “officers” for constitutional purposes was not enough to save the qui tam provisions from the fundamental Article II infirmity the court identified. That ruling was appealed and, after full briefing, including by the government and a bevy of amici, the litigants stepped up to the plate this morning for oral argument....

View All Insights