The ICO have recently published their findings that many public sector bodies, including NHS organisations, still do not have appropriate policies, processes or staff training in place to ensure compliance with GDPR.