So the suits swanned off to GDPR events leaving you at the coalface? It's really more IT's problem

They might have to worry about it, but you'll be 'doing it'

I spend a lot of time telling people that information security isn't the IT department's problem. And it's not: everyone in the business is responsible for making his or her contribution to the security of the organisation's information, and for protecting the personal data the organisation uses."