First steps, templates, etc.
Employee training, licensing, etc.
Data processing resources must be protected.
What are the GDPR rules? When is it legal?
Who is the data controller and who is the data processor?
Rules for data transfers to outside the EU/EEA.