Overall, GDPR readiness seems to be high among large UK, German and French enterprises, with two thirds telling the firm they had put in most or all of the security measures needed to comply with it.
The figures were as encouraging for the EU's high-level Network and Information Security (NIS) Directive, with 39 percent confident they had done everything required to meet its requirements, and 37 percent rating their readiness as at least good.
This contrasts with a November survey that found that half of IT staff in the same three countries weren't even sure what GDPR stood for, although in that example participants were drawn from firms with a wider range of sizes.
More surprisingly, data protection and security legislation that was meant to grab the full attention of management seems in 62 percent of cases to have become the primary responsibility of IT staff, followed by legal department on 36 percent and outside consultants on 34 percent.
There is some ambiguity in how one might interpret this. It could be that management have limited their role to planning oversight or it could be that the sheer complexity of implementation is just beyond non-specialists and so firms are relying on IT staff to make the right calls.
For now, a quarter of respondents said that the biggest challenge to meeting the demands of the GDPR was the investment in new hardware and software required, followed by 18 percent worried about wrangles over data policy.
The impact the GDPR would have on breaches, their reporting and aftermath remains at the forefront of anxieties.
"The new EU security and privacy requirements are incredibly important and will greatly increase the security obligations of European organisations," said FireEye's international government affairs director, Adam Palmer.
"We encourage organisations of all sizes to adopt mitigation measures that will manage risk stemming from zero-day exploits and never-seen-before malware as these attacks constitute a majority of advanced attacks in today's threat environment."
Meanwhile, the GDPR rumbles on through its complex layers of approval, with the Commission and the current Latvian presidency committed to tying up as many loose ends by June.
Exactly when the GDPR will emerge from the discussions among the Justice Council and head for the European Parliament for the last time is still up in the air. Using the annual Data Protection Day as a prompt, Vice-President Andrus Ansip and Commissioner Vra Jourov issued a statement that at least reiterated the accepted timetable.
"We must conclude the ongoing negotiations on the data protection reform before the end of this year. By the 10th European Data Protection Day, we are confident that we will be able to say that the EU remains the global gold standard in the protection of personal data," they said.