With the GDPR in force for more than a year, most companies have spent a lot of time and money to implement the new requirements under data protection law.