It was no surprise to see that the European Union’s General Data Protection Regulation (GDPR) dominated discussions at the International Association of Privacy Professionals (IAPP) Global Privacy Summit held in Washington, D.C. last week. The event, attended by nearly 4,000 legal and privacy professionals, featured eye-opening discussions and insight into the ever-changing privacy landscape.

Data protection authorities from more than 30 countries shared their thoughts on protecting individuals’ personal data.

Here are three key takeaways from the experts:

1. There Will Be No Grace Period for GDPR

Enforcement starts immediately on May 25, 2018. In multiple sessions, authorities stressed how organizations have had two years to prepare for the requirements under GDPR and must be compliant immediately. Infusing the conversation with a bit of humor, the chair of the Article 29 Working Party, Austrian Data Protection Commissioner Andrea Jelinek, quipped, “Well, May 26 is a Saturday, so we will have a grace period over the weekend.”

2. Organizations Need to Conduct Simulations to Prepare

Speaking to a crowded room, Jelinek expressed the importance of use-case simulations. She recommended that organizations simulate a data breach incident and test all components and systems of their data breach response plans to ensure they can meet the tight 72-hour notification requirements.

3. Organization-Wide Involvement Will Be Key to Success

Privacy professionals cannot prepare alone; it requires a multidisciplinary team approach. As Isabelle Falque-Pierrotin, former Article 29 Working Party chair and current president of the French Data Protection Authority (CNIL), stated, “It’s a change of culture in your company. You need to make sure that this question of compliance is not focused on the legal departments but throughout the company… It has to rise to all levels of the company and obey to a strategic decision from the top.”

Watch the on-demand webinar: Cyber Security in 2017 and the Year Ahead

Clients are responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation. Clients are solely responsible for obtaining advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulations that may affect the clients’ business and any actions the clients may need to take to comply with such laws and regulations. The products, services, and other capabilities described herein are not suitable for all client situations and may have restricted availability. IBM does not provide legal, accounting or auditing advice or represent or warrant that its services or products will ensure that clients are in compliance with any law or regulation.

Learn more about IBM’s own GDPR readiness journey and our GDPR capabilities and offerings to support your compliance journey here.