To further that point, this is a quote [0] from the UK's ICO on that: > It’s an evolutionary process for organisations – 25 May is the date the legislation tak

To further that point, this is a quote [0] from the UK's ICO on that: > It’s an evolutionary process for organisations – 25 May is the date the legislation takes effect but no business stands still. You will be expected to continue to identify and address emerging privacy and security risks in the weeks, months and years beyond May 2018. > That said, there will be no ‘grace’ period – there has been two years to prepare and we will be regulating from this date. > But we pride ourselves on being a fair and proportionate regulator and this will continue under the GDPR, as I set out in my first myth busting blog. Those who self-report, who engage with us to resolve issues and who can demonstrate effective accountability arrangements can expect this to be taken into account when we consider any regulatory action. [0] https://iconewsblog.org.uk/2017/12/22/gdpr-is-not-y2k/ https://iconewsblog.org.uk/2017/12/22/gdpr-is-not-y2k/