Studies show that many companies are still scrambling to come into compliance with the European Union’s General Data Protection Regulation, which goes into effect May 25.

In the midst of the rush toward compliance, some of these companies and their legal departments will have to focus not just on how to change the way they handle customer data, but on how to handle data pertaining to their own employees as well.