I don't think it's useful to use laziness to describe this, as it's needlessly perjorative. It may be that they've decided that the ROI is not there for complyi

I don't think it's useful to use laziness to describe this, as it's needlessly perjorative. It may be that they've decided that the ROI is not there for complying with GDPR, or that the risk of an inadvertant fail is too high and expensive. Laziness may be the case, but it's unwise to assume.