Part 2 – Time is running out. GDPR compliance is not just best practice, it is the law