There are many GDPR talks, groups and legal organisations that are offering advice on data protection. To summarise, all organisations and individuals need to take ownership of the data they hold. From an IT perspective, take a look at your IT and by all means use the below check list as a starting point.
In no particular order and not exclusively:

The main point of the new GDRP regulations is that you show you’ve done all that you can in order to help reduce the chance of a data breach and misuse. Prevention is better than the cure! If you think about it, we’ve been doing most of the above already, so it just needs documenting. Care Micro can assist in auditing, supplying, implementing and supporting most of the above, learn how to contact us.