Indeed. But if you are a large enough target, you will employ specialized external firms that deal with GDPR, or else.