Blog

An article by VentureBeat gives a nice analogy of the different stages in which companies find themselves with regard to the implementation of the GDPR (here in the Netherlands referred to as the GDPR). It also applies here that quite a few companies are still not aware of harm, and are therefore still in the first stage.

So here a short translation and summary of the article:

1. Shock and denial
At this stage, companies have no idea what the GDPR means and whether they should do anything with it at all. Let alone have a strategy to tackle this.

2. Pain and guilt
Organizations are at this stage when they see the GDPR as an unnecessary hassle, want to waste as little time as possible on it and actually secretly hope that it will all go away on its own and that nothing else happens.

3. Anger and Negotiation
Organizations do as little as possible at this stage to become compliant and get rid of it. The GDPR fines depend on the violation so there is usually a trade-off at this stage of what is acceptable and what is not. It is important to realize that even if you only get a (relatively) low fine, you still run a lot of risk in the long run if you don’t get things right.

4. Depression, reflection, and loneliness
At this stage organizations are not yet fully aware of how much work the GDPR actually is, sometimes it can seem overwhelming, the people in the organization who are actually working on the GDPR are not yet really getting a grip in the larger population within the organization.

5. The Upward Path
At this stage, organizations have gained insight into what they have already achieved since they started implementing the GDPR, but are not yet sure what exactly is needed to become fully compliant by 25 May 2018. In this case they are going for the risk-based approach to non-compliance. The Dutch Data Protection Authority will not issue fines for non-compliance if it can be made clear with good arguments why a company is not yet ready and it can be indicated when it is.

6. Reconstruction and work through
In the penultimate stage, organizations have already made a lot of progress and are about ready for the May 25 deadline. They just do not yet have a complete grip on it, and have not yet fully mapped out their processing and processes.

7. Acceptance and hope
In the final stage, the organizations realize that greater transparency not only leads to more trust, but also more input from people who themselves want to participate actively in a process, for example giving feedback or receiving marketing emails (because if they have explicitly indicated that they want to receive offers, they are more likely to respond).