Many firms still stuck in GDPR prep phase six months after its initiation