A lot of "GDPR work" I have witnessed recently has been totally useless and frankly I'm still not sure why I understand the tortuous paths some have chosen to f

A lot of "GDPR work" I have witnessed recently has been totally useless and frankly I'm still not sure why I understand the tortuous paths some have chosen to follow. I think a lot of that is down to decisions taken by US-based management that is simply clueless about how law works outside the US. And probably also only got their information from US-based lawyers that were either as clueless as themselves, or had incentives to make everything look very complicated. On the other hand, most of the companies around me that have no links with the US were not particularily worried, and either consider that they are already compliant, conducted minimal work to be acting in good faith, or at worst are waiting for the regulatory body (CNIL here) to tell them what they are doing wrong, if that is the case. However, I don't know any company that does shady things with their users' data, and things might be very different for those.