The arrival of GDPR and the associated threat of significant administrative fines or ability of data subjects to sue for material or non-material damage means that data protection is a key compliance consideration for any business that holds personal data whether about employees or customers or on behalf of third parties. It is essential for all businesses to understand their obligations and not only comply but be seen to comply by ensuring that appropriate policies, records and training are in place and documented.