The response is across the board. Some companies (B2B, larger enterprises) take it very seriously: form a compliance team, dedicate a budget for tools/consultan

The response is across the board. Some companies (B2B, larger enterprises) take it very seriously: form a compliance team, dedicate a budget for tools/consultants etc. Others have a "fuck it" attitude, self-author a 1-page PDF declaring GDPR compliance and documenting the "process", and wait for how the enforcement will pan out in reality. Most do the absolute bare minimum, hoping to claim "good faith" when (if) shit hits the fan [0]. The funny thing is, the larger enterprises have no idea what data they even have. Or where it is (never mind whether there's PII in it, or if it's compliant, or how to find out). They've acquired smaller companies left and right over the decades, each with their own databases, data shared in the cloud, forgotten backups, archives… A complete mess. The "discovery cost" for doing things by the book there is significant. We built some AI-enabled software to help with GDPR discovery (pii-tools.com), and the responses are varied, across the board. It's really interesting to watch the whole field progress and evolve through the imposed chaos. [0] "Having larger fines is useful but I think fundamentally what I'm saying is it's scaremongering to suggest that we're going to be making early examples of organisations that breach the law or that fining a top whack is going to become the norm. Our office will be more lenient on companies that have shown awareness of the GDPR and tried to implement it, when compared to those that haven't made any effort." - Elizabeth Denham, UK's information commissioner (in charge of data protection enforcement)