The GDPR will become effective on May 25, 2017. It specifies the security and information governance requirements of the handling of information of any EU resident with which a US company (or any global company) does business, or whose internet activity is monitored from anywhere. The fines are capped at 20 million Euros or 4% of global turnover, whichever is larger. I will discuss the most pressing aspects of the law on how information is managed and the changes required to most businesses’ information infrastructures. I will compare EU law to US law and show the increasing liability for failure to meet privacy and security protection expectations. I can determine the most pressing issues of the audience and focus on their legal implications. I can also discuss certifications currently required to show competence in privacy management.