The General Data Protection Regulation (GDPR), which comes into force on 25th May 2018, will significantly change the way organisations operate and deal with data. Non-compliance could lead to significant financial penalties of up to 4% of global annual turnover. This is critical when one considers that current legacy security systems and data handling practices are both a non-compliance and a cyber security risk for most organisations. Proactive organisations are already taking measures to re-evaluate and transform their data protection and privacy agenda to prepare for GDPR compliance. In this insight, we identify the major GDPR implications and provide key guidelines to achieve compliance.