Mate - even in my business it is - and remains - one major clusterfuck!
That said, an industry association I'm a director of and on the management committee for, employed external counsel to write a legal statement on data storage / use, and all members who use their website will have to consent to GDPR, or their access will be revoked.