The main area of ambiguity in my opinion is around "legitimate interests". Many companies who would otherwise breach GDPR regulations are using this as a get ou

The main area of ambiguity in my opinion is around "legitimate interests". Many companies who would otherwise breach GDPR regulations are using this as a get out of jail free card, particularly sites/applications which collect personal data without consent. Personally, I think there will be a number of court cases post-GDPR to clarify what precisely is "legitimate interest" and what is a breach of the regulations.