--- title: "Six Months In, GDPR Compliance Concerns Linger" id: "44827" type: "post" slug: "six-months-in-gdpr-compliance-concerns-linger" published_at: "2018-11-21T18:28:15+00:00" modified_at: "2026-03-16T23:11:07+00:00" url: "https://associationsnow.com/2018/11/21/six-months-in-gdpr-compliance-concerns-linger/" markdown_url: "https://associationsnow.com/2018/11/21/six-months-in-gdpr-compliance-concerns-linger.md" excerpt: "The European Union’s General Data Protection Regulation remains a difficult-to-grasp wild card for many organizations, with compliance concerns still top of mind. In one recent study, some organizations said full compliance might be impossible." taxonomy_category: - "Governance" taxonomy_post_tag: - "AssociationsNow" - "Compliance" - "privacy" - "Regulations" - "Technology" taxonomy_content_format: - "Article" taxonomy_role: - "C-Level" - "Director" - "Manager" - "VP" taxonomy_persona: - "Executive Leadership" --- [Home](https://associationsnow.com/) » [Articles](https://associationsnow.com/format/article/) » Six Months In, GDPR Compliance Concerns Linger Six months after the effective date of the European Union’s General Data Protection Regulation, organizations are still grappling with GDPR’s practical impact and compliance challenges. More than half of respondents to [to a recent survey (opens in a new tab)](https://iapp.org/media/pdf/resource_center/IAPP-EY-Gov_Report_2018-FINAL.pdf) [PDF] by the International Association of Privacy Professionals (56 percent) said they still haven’t complied with the regulation, and one-fifth said that full compliance may be impossible. The average organization spent $3 million on compliance efforts. “But there is good news: The GDPR looks a lot less complicated and confusing in practice than it initially did on paper,” IAPP said [in a news release (opens in a new tab)](https://iapp.org/resources/article/iapp-ey-annual-governance-report-2018/) . “While privacy professionals are still struggling with certain tasks, difficulty scores have dropped considerably for every individual compliance process.” Lingering issues with GDPR may be creating side effects that could prove problematic in the long run. Among them: **Headaches in the merger process.** A recent report from Merrill Corporation [says that acquisitions in many parts of the world (opens in a new tab)](https://www.businesswire.com/news/home/20181112005447/en/GDPR-Burdens-Hinder-MA-Transactions-EMEA-Region) , including the European Union, Middle East, and Africa, have been held up due to concerns with GDPR compliance. More than half of respondents said that compliance concerns with a target firm that emerged in the due-diligence process stopped an acquisition dead in its tracks, and two-thirds said it would lead to increased scrutiny. **Unexpected security problems.** Recently, a plug-in used by a number of WordPress sites for GDPR compliance purposes [was hacked (opens in a new tab)](https://www.zdnet.com/article/zero-day-in-popular-wordpress-plugin-exploited-in-the-wild-to-take-over-sites/) , allowing attackers to store malicious commands in a WordPress installation. [The attack (opens in a new tab)](https://nakedsecurity.sophos.com/2018/11/13/wordpress-gdpr-compliance-plugin-hacked/) was ironic: A plug-in intended to protect data privacy could itself be used for identity theft. GDPR creates new variables, and similar attempts to take advantage of them may crop up in the coming months. **Departures from the EU market.** Some organizations have chosen to comply with the regulation by removing their websites from the European market entirely. [In the media space, for example (opens in a new tab)](https://digiday.com/media/u-s-sites-continue-block-european-visitors-post-gdpr/) , Tribune Publishing (which recently reverted to its original name, from Tronc), has blocked EU visitors from accessing most of its news outlets, with a promise that they will eventually be able to return. But this strategy seems unlikely to be effective in the long run, as support for [new data privacy rules](https://associationsnow.com/2018/11/momentum-picks-up-for-federal-data-privacy-protection/) in the U.S. is growing. **Confusion about violations.** There remains substantial uncertainty about whether compliance efforts actually meet GDPR’s requirements. At *Digiday*’s Programmatic Media Summit, [an unnamed participant mused (opens in a new tab)](https://digiday.com/media/we-almost-need-someone-to-get-in-trouble-over-gdpr-overheard-at-digidays-programmatic-media-summit/) , “We almost need someone to get in trouble to set an example for the rest of us to know what not to do.” Because that example has yet to emerge, organizations are likely to be wondering whether all the work they put into compliance was enough. (Martin Janecek/iStock/Getty Images Plus) [Ernie Smith](https://associationsnow.com/author/ernie-smith/) Ernie Smith is a former senior editor for Associations Now. [More articles by this author](https://associationsnow.com/author/ernie-smith/) Tags: [#Compliance](https://associationsnow.com/tag/compliance/) [#privacy](https://associationsnow.com/tag/privacy/) [#Regulations](https://associationsnow.com/tag/regulations/) [#Technology](https://associationsnow.com/tag/technology/) **Stay Informed** [Subscribe to our free newsletter](https://associationsnow.com/newsletter/) , *Associations Now Daily News*, to find out what’s happening in the association world every business day. ## You Might Like - [VideoSmarter Board Management for Associations: An OnBoard ShowcaseJuly 24, 2026](https://associationsnow.com/2026/07/24/smarter-board-management-for-associations-an-onboard-showcase/) - [PodcastAssociations Now Presents: Beyond the Tech Stack: How AI Is Changing the Association PlaybookOctober 29, 2026](https://associationsnow.com/2026/10/29/associations-now-presents-beyond-the-tech-stack-how-ai-is-changing-the-association-playbook/) - [PodcastAssociations NOW Presents: Leading Together-Strengthening the Board-CSO PartnershipDecember 18, 2025](https://associationsnow.com/2025/12/18/associations-now-presents-leading-together-strengthening-the-board-cso-partnership/) - [ArticleFive Years Post-GDPR, Data Privacy Even More ImportantMay 10, 2023](https://associationsnow.com/2023/05/10/five-years-post-gdpr-data-privacy-even-more-important/) ## Comments **Comments are for ASAE members.** [Learn more about comments on this site.](https://associationsnow.com/comments/) [Log in](https://associationsnow.com/login?redirect_to=https%3A%2F%2Fassociationsnow.com%2F2018%2F11%2F21%2Fsix-months-in-gdpr-compliance-concerns-linger%2F%23comments) to your member account or [join ASAE](https://my.asaecenter.org/select-a-membership-type/) !