Yep. And you can extend that to all security compliance, not just GDPR. The biggest driver for compliance is being able to give solid answers on VSA questionnai

Yep. And you can extend that to all security compliance, not just GDPR. The biggest driver for compliance is being able to give solid answers on VSA questionnaires, not actually being secure. Certainly not fear of getting fined or failing an audit. The number of companies who get caught is so small, and the amount they get dinged for is so minuscule that it's not even a concern for them once they figure out how it works.