When preparing for the GDPR, there is a broad range of expertise that is required, from having experience with the practical implications of applying data protection and information security, to managing an operational environment, to implementing information governance practices, to applying change management in complex regulatory circumstances.