New regulations always mean a flurry of activity for affected companies, and the European Union’s new General Data Protection Regulation is no exception.

The bill passed in 2016, but it gave companies two years to fall in line. That means the deadline of May 2018 is looming for companies with consumer data interests in the EU.

Not making that deadline could mean fines and civil suits. And then there’s the possibility of cultivating a bad reputation for not caring enough about the protection of personally identifiable data of consumers.