Thanks Pete. Tbh, my board is so tiny and under the radar I don't think in practice I need to do anything.
To be honest, I don't think GDPR is even meant for small companies. I think it is part of a bigger EU/US trade war. The EU is very protectionist and getting worse by the day. The squealing about tariffs on steel is ridiculous. Why shouldn't America put tariffs on something it doesn't need? The point of trade is you trade the things you have a surplus of, for the things you need. America doesn't need steel. It can make enough of its own. Iron ore is very common, America has no shortage of labour.
GDPR is aimed squarely at tech giants. Facebook, Apple, Google. They are looting European countries. They give you nothing (nothing physical) and you give them money ... and then they find ways to pay zero tax on those sales. Europe doesn't have a single large tech company.
No EU search engine, no mainstream OS (Linux doesn't make money like Android, iOS or Windows), not a single large social media platform, no massive cloud companies like Amazon or Cloudflare or Microsoft, no massive online shops like Amazon, no huge streaming websites like youTube, Netflix or Twitch ... they've f'all. Hammering Tech doesn't hurt them at all, because there is no industry to hurt. The EU already killed every single tech company in Europe through over regulation over the last 30 years.
Phillips no longer make TVs, Siemens and Vodaphone don't make phones, ARM was the only silicon chip interest but that's been sold abroad, software companies like Amstrad, Sinclair, Atari ... all gone. Since the EU was formed and started legislating, the entire continent has regressed from being an Quaternary economy to a tertiary/secondary economy. We only do services (tertiary) like banking, but even lots of manufacturing and things like call centres have all gone abroad.
Rather than take a hard look at themselves and realise their protectionist policies have been utterly destructive to their own high tech businesses, the EU (arrogant unelected technocrats that they are) are digging their heels in even further. In trying to reduce the US and East Asian influence by regulating, they're going to make it impossible for pretty much anyone to have a global tech company in the EU.
Still, the ray of sunshine is Brexit ... maybe we can turn it around but Teresa May probably needs removing first.