If I could offer only once piece of advice it would be do data-mapping

I’ve recently finished a data mapping exercise for a Care Home getting ready for GDPR and I would say that doing the data mapping early is really very useful.

All sorts of things become clear after you have done a step-by-step map of the customer experience and understand the data, privacy, security, access and back-up.

It really helps with drafting data-impact assessments, privacy notices, as well as necessary data controller-processor agreements.

It is also a great opportunity to simplify and communicate the process for both customers and staff.

If you are in a quandary about where to start with GDPR I think a data mapping exercise is probably the best place to start because it will quickly identify if you have any issues or not, and if you can easily do everything in-house with some modest changes or actually need a bit of external support.