GDPR is basically written as something to be hashed out in court. The question is not "Are you compliant?". The question is "Can you use what you've done to tel

GDPR is basically written as something to be hashed out in court. The question is not "Are you compliant?". The question is "Can you use what you've done to tell a convincing story that you're compliant enough that you shouldn't be punished after a breach? When someone at the regulator's office might be looking to make their career over the corpse of your company?".