Following my offer to review and upgrade sites to provide improved security for GDPR (see this item) and the inclusion of a Privacy Statement or Policy from the organisation I have modified 17 sites out of 130 sites.
Many organisations do not appear to have done anything, and one could argue after the GDPR deadline, not much has happened. If you have not taken any action, I would encourage you to do so. Most of GDPR applies to what you do behind the scenes in your internal operations. I cannot help you there. But there are parts that can affect your website which I can help you with.