Another quote of mine is up on the Tripwire State of Security blog: https://www.tripwire.com/state-of-security/privacy-milestone-expert-thoughts-gdprs-2nd-anniversary

Far too many businesses are finding that they have insufficient identification mechanisms in place to support their GDPR assessments, thus hindering their implementation of related controls.