1. Denial

It’s not about us. We do not have sensitive data. It will not be implemented. People won’t understand it or adopt it. We are too small to matter. Who will dig up our sh*t, anyway?

2. Anger

Those bastards in Brussels, what else they will come up with? F*ck them, we won’t do anything. Let them come. We will deliver trouble.

3. Bargaining

If we change our contracts to look compliant, will we avoid detection? If we move outside Europe? If we delegate to third parties? If we delay a few months past the May 25 deadline?

4. Depression

We will never make it. We don’t have the skills or the resources to comply. If we get sued, it’s game over.

5. Acceptance

Roll up sleeves. Get a quotation from this consultant. Arrange a meeting with that lawyer. Dig up this diagram with your processes. Dig in your data files. Get insurance coverage. And, God help us.