Trying to limit both the probability of a data breach happening and the severity of it should it still happen, e.g.:

1. Enforcing FileVault etc. on company laptops. 2. Internal storage: Reviewing servers' security, limit duplication of sensitive data, review access control 3. Checking external dependencies: where do third parties store data? E.g. Dropbox is not GDPR compliant yet[0], they are cutting it fine. 4. Enforcing 2FA. 5. Ensuring we have an audit trail of having assessed the GDPR impact.

[0] https://www.dropbox.com/help/security/general-data-protectio...