This essay is a comparative study of nine Swedish organizations. The purpose was to examine how nine Swedish organizations has prepared for the forthcoming General Data Protection Regulation (GDPR) which will replace the national PUL directive from 1998, on the 25th of May 2018. The new regulation implies higher demands on how organizations within EU handle personal data. Earlier studies has discovered that there is general a lack of awareness and preparations among organizations. With that in mind this study was created to examine if the organizations were more aware and prepared now that GDPR soon will go live.  
This study uses John P Kotters eight step model to describe the organizations different ways to approach GDPR as an organizational change project. The study was conducted by semi-structured interviews with nine different organizations. The result of the interviews were used to create themes based on Kotters model, that were used to analyze the empirical result. As a summary the study concluded that eight of nine examined organizations suggested that they were prepared for GDPR. The main differences in the organizations preparations for GDPR was due to difficulties in interpreting the law, which lead up to variations in terms of the scope of the GDPR-project