What is the first thing a company can do in its GDPR journey?

The first step a company can take in its GDPR journey is to get organizational buy-in and build a team. This is a crucial foundational step because compliance with GDPR requires commitment and collaboration across various departments within the organization. By securing buy-in from leadership and establishing a dedicated team, the company can ensure that everyone is aligned and understands the importance of data protection and privacy. This team can focus on developing strategies, setting goals, and ensuring accountability, thus laying the groundwork for all subsequent actions related to GDPR compliance.

Taking necessary actions like conducting a privacy impact assessment, compiling training materials, or deleting unneeded personal data are indeed important steps that follow afterwards, but they are more effective when facilitated by a coordinated and prepared team that understands the company's goals and the requirements set out by GDPR.