I think a key part of GDPR "Privacy by design and default" that is missed is that it isn't just technical, it is ensuring staff are knowledgeable , organisational process supports it and company values embrace it.  Compliance isn't a tick box exercise to achieve by May 25th 2018, it is a change (for the better) in ways of working that means you will maintain compliance on May26th, May 27th and onwards.