Planning For “What If”: Why Now is the Time to Add GDPR Noncompliance to Your Crisis Plan

• Trends
• June 6, 2018
• by Karen Carrera, APR

It’s going to happen.

The European Union’s new General Data Protection Regulation (GDPR) is so comprehensive and far-reaching, that at some point a company that thought it had covered itself will get hit with a charge of non-compliance or data breach. The implication will carry a stiff fine, and with that punitive power, it’s an easy bet that the first offenders will find themselves very publicly held up as an example of what will happen to others who play fast and loose with customer data.

If you have any business dealings in the EU – and PwC reports that 92 percent of US companies with interests in other countries named GDPR a top priority, and 77 percent plan to spend $1 million or more on compliance – it’s time to dust off your crisis plan and invest some time and money in how your company will respond to non-compliance or data breach charges.

GDPR is so new, with both specific and vague guidelines, and the fines so severe, that first offenders will spend millions on lawyers and legal battles trying to argue against ambiguities and intent. But few will consider how that battle plays out in the press, with investors, employees and customers, or in the community.

Court room vernacular rarely translates well in the news. Companies must carefully craft a strategic, impactful and focused message to be communicated through the media and marketing channels, including social media. That message must resonate with an intended audience, align with the legal strategy, and integrate with other messages the company has communicated on its efforts around GDPR.

While GDPR is new, the idea of preparing for the worst certainly isn’t. Smart companies have learned how to prepare for crisis and shore up their reputations before the inevitable happens. With the initial operations and communications for the May 25 deadline behind us, now it’s time to sit down and plan for “what if.”