Advice for companies that haven’t yet complied with GDPR