I've been involved in the GDPR-proofing of the company that employs me in the UK, and find that the questions are the same that our consultants put to us when i

I've been involved in the GDPR-proofing of the company that employs me in the UK, and find that the questions are the same that our consultants put to us when identifying where we stood. Based on my experience (medium sized manufacturing company) I think that the letter really becomes a nightmare when the company receiving it has not looked into it at all, or when their business model relies on being able to ignore consent from users for their processing; in other cases, and especially for any company that sells to businesses rather than individuals, GDPR compliance is really not that bad IMO.