Companies may think they are ready for GDPR, but their employees are not