One in three companies has not yet dealt with the General Data Protection Regulation