Just shy of one year into the European Union’s General Data Protection Regulation, companies and their legal departments should double-check they are keeping up with the law or face fines and other punishments, according to experts.

The GDPR was implemented May 25, 2018, and in the first year fines were not as large as anticipated.