38% of organisations rate themselves as only ‘Initial’ in terms of GDPR readiness.