Among the many provisions of the GDPR with which companies are grappling is Article 10, which affects the processing of personal data relating to criminal activity. This kind of data collection is a core part of many different types of diligence and investigations. Article 10 “will basically put companies subject to both the GDPR and non-E.U. laws between a rock and a hard place,” potentially subjecting them to “the wrath of the U.S. Department of Justice,” for example, Alja Poler De Zwart, counsel at Morrison Foerster in Brussels, told the Cybersecurity Law Report. This article discusses how companies can approach Article 10 and the patchwork of applicable member-state laws. See “The GDPR’s Data Subject Rights and Why They Matter” (Feb. 28, 2018).