A year on since GDPR, many organisations are yet to stop fretting over fines and focus instead on business value