In early 2016, a new piece of legislation known as the General Data Protection Regulation (GDPR) passed in the EU. At first, this news was a blip: As a marketer, I spend my days working to reach and influence potential buyers, not on governance, risk or compliance (GRC). I hadn’t yet considered my role in managing risk under my line of business outside of CAN-SPAM or phishing training for the Marketing department. So, it’s not too hard to fathom that when I was tasked with leading the GDPR compliance initiative at a previous employer, I was way out of my comfort zone.