This was a very real argument put to me by a potential GDPR training client last week.

Her logic - that GDPR had now been enforceable for four weeks, she had not registered with the ICO, she had heard nothing from the ICO, the business owners she socialised with locally had similarly heard or seen nothing, the training, policies, and procedures were running into hundreds of pounds, so risk against reward, why should she bother?

At first glance, she had a point, but let's look at some reasons why she was wrong

Having spoken to well over 120 companies and organisations now, the key recurring message is either "GDPR, oh yeah, that's an IT thing isn't it?" or "GDPR, oh yes, our marketing team are taking care of that".

The truth is that GDPR is not solely an IT thing, nor is it solely a marketing thing, nor indeed is it a solely a customer service thing or a finance thing. GDPR is a whole company thing.

I'm sure I can't be the only person who saw a deluge of emails into their inbox in the ten or so days leading up to Friday 25th May 2018.

If it were an orchestra, this score may have had a muted opening sequence but by the time it got to the climax, the crescendo was running full blast!