The GDPR marathonTwo years on from the GDPR's implementation, Suzanne Dibble considers best practice for law firms