Just four months into the General Data Protection Regulation (GDPR), the jury is in: Europe has seized a first-mover advantage and set the terms of the global privacy debate. Whatever its virtues or flaws, the GDPR is now the de facto global standard that other countries' privacy regimes are measured against, and countries around the world are adapting their own laws accordingly.

As the United States begins a meaningful dialogue about a national privacy law, the GDPR will likely dominate the conversation once again. Ensuring rough equivalency (or, in GDPR parlance, “adequacy”) with data protection standards in the European Union (EU)—and protecting lucrative cross-border data flows—will be a critical function of any U.S. data privacy law. At the same time, the process of crafting a comprehensive law presents U.S. lawmakers with the opportunity to recapture a global leadership role on privacy norms and to promote a template that will reduce barriers to international business.