That was the message from Trina Cotes, strategic development director, Kuoni UK, at the Hands on with GDPR forum, organised by the Travel Technology Initiative in London this month.

There are just seven months until the new General Data Protection Regulation (GDPR) comes into force, giving consumers greater rights to privacy and forcing organisations to be more transparent about the personal information they hold.

Cotes said: “It’s not just about senior management [being informed about the law]. In theory, you could have anyone call customer services and say ‘I’ve got a problem with my data’, and the staff need to know what to do”.

Steve Taylor, development project manager with Kuoni, added that the organisation is using the company’s intranet to keep people informed.

Cotes said Kuoni has 320 agents across 48 stores and that the key factor now is the “drop-dead date of May 25”. “The perception is that there’s still plenty of time. There isn’t,” she warned.

She likened GDPR to Atol, with the regulation likely to “come into customer consciousness” in the same way Atol was highlighted after Monarch.

However, Dai Davies, GDPR expert at Percy Crow Davis & Co, sought to allay fears over the new maximum fines the Information Commissioner’s Office (ICO) can impose under GDPR, which are up to €20 million or 4% of turnover (whichever is greater). He told delegates that in 2016, just 13 companies were fined by the ICO, with the average penalty £100,000.

Nick Towers, managing director of digital marketing agency Sagittarius, said GDPR could be positive for savvy companies, arguing that the data that is given will be “better”.

“This is because you will only receive data from people who have freely chosen to give it, and it will only be from those that are genuinely interested in what you have to say,” he said. “By being more honest, you will end up with better relationships with your customers,” he added.

The ICO will launch a dedicated telephone service on November 1, aimed at helping small businesses prepare for new data protection laws.