“Following the GDPR” is easy for most companies because the amount of personal data they keep and have at risk is extremely low. The ICO has some great guidance

“Following the GDPR” is easy for most companies because the amount of personal data they keep and have at risk is extremely low. The ICO has some great guidance for them: https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/ > “Don't worry, the european courts are nice people" is not a strong enough guarantee for most people and corporations. The GDPR is already law and people, and corporations are still here. That’s how courts work in Europe. They can fine you for hurting consumers or putting them at risk even if the specific actions you’re taking aren’t necessarily coded and specified. As an American living here I understand how strange that can seem, but the advantage is that companies getting prepared for the GDPR are treating the personal data they keep as a liability instead of treating it as an asset.