One of the biggest mistakes a business can make is to see GDPR as a one-off campaign rather an ongoing reality.