Following the enforcement of the GDPR in May 2018, CartONG has embarked upon a process of institutionalizing responsible data management in-house. In this article, we invite you to discover the main steps of this change management process that we have been implementing for more than 18 months now, and the key lessons we have learned from it.