Having dealt with 2 DPAs (UK and DE) it is guilty until proven innocent I think you may be thinking of the rights of seeking damages under the GDPR which is utt

Having dealt with 2 DPAs (UK and DE) it is guilty until proven innocent I think you may be thinking of the rights of seeking damages under the GDPR which is utterly irrelevant to the core enforcement of it. I think have way too of a rosy outlook on how laws are enforced in the EU much of the enforcement is contradictory to the ideals you hold in such high regard. Charities are one of the most common targets of data protection enforcement in the EU even before the GDPR, in the UK they are collectively the sector that gets hit the most by the ICO and the picture isn’t much different on the continent and one of the main reasons for that is that they are easy targets (this does not mean they didnt do anything wrong but they are easy targets nonetheless).