This site is not made by an agency that sells anything (as far as I know). It is made by the French government agency which enforces the GDPR and which main mis

This site is not made by an agency that sells anything (as far as I know). It is made by the French government agency which enforces the GDPR and which main mission is helping out companies complying with the GDPR (distributing fines is NOT their goal, they will only fine companies as a last recourse). As such, it's one of the best guides you can find around, because everything you find in there is almost guaranteed to be exact (contrary to some companies selling compliance tools that are not compliant, or a random blog on the internet). And if there is any mistake there, well you can refer the CNIL to its own guide when they investigate you. Obviously they want to make a guide to get to 100% compliance, but they as you said in your last phrase, they indeed don't have the manpower to investigate everyone, and if you are generally respectful of your users privacy, you don't handle sensitive data at a large scale and don't have any complaint against you, they have no reason to ask you for documentation (which is generally going to be the first step of an investigation).