Even if your institution considers that it has already implemented all the requirements of the GDPR, can you guarantee that you have adequate evidence that your contracts, website, IT applications, data processing, business processes, etc. continue to guarantee compliance?