Eight Ways Board Directors Should Be Preparing for the GDPR Right Now