The EU General Data Protection Regulations (GDPR) start next year, but many firms are ill prepared.