Organisations are running out of time to get ready for the biggest shakeup in European data protection rules for decades.