While you have been on your summer holidays, the ICO and other European Data Protection Authorities have been keeping busy. Large and small firms have been investigated and fined for having insecure data file transfer and storing systems in place, making unlawful marketing calls and having inadequate, or in some cases, no GDPR training programmes in place.
https://www.legalfutures.co.uk/associate-news/no-summer-holiday-for-european-data-protection-authorities