By Karen Neuman and Federica De Santis (June 28, 2017, 2:19 PM EDT) -- In one of the most significant global privacy developments in the past 20 years, the European Union has adopted a new data privacy law, the General Data Protection Regulation 2016/679. The GDPR is intended to harmonize European privacy requirements for companies doing business in Europe. It goes into effect on May 25, 2018, replacing the existing privacy regime (EU Directive 95/46/EC – Directive). The GDPR introduces sweeping changes, including a requirement that will be unfamiliar to many companies with EU operations — the requirement to report data breaches to EU data protection authorities and, under certain circumstances, to affected individuals, within tight time frames. Companies should act now to assess internal plans and processes to detect, investigate, report and document data breaches, and manage any fallout from such reporting. Violations can result in hefty fines and reputational harm, and could potentially affect shareholder value or a company's purchase price in the event of a transaction. This article focuses on the GDPR's breach notification regime and suggests some practical steps that can be taken to comply with new requirements....