I'm not sure what would people expect for GDPR to apply in "full" in the workplace. (TBH I'm not even sure what would most people expect from GDPR, apart from b

I'm not sure what would people expect for GDPR to apply in "full" in the workplace. (TBH I'm not even sure what would most people expect from GDPR, apart from being annoyed with cookie questions while browsing the web, but let's concentrate on people who know their rights and would potentially want to exercice them.) And even then, GDPR applies, and in a good amount of cases require even more strict measures than "baseline" GDPR. E.g. employees are considered "vulnerable" because of the employee / employer relationship, and that often implies that Privacy Impact Assessments are required (fulfil one criteria and as soon as 2 are presents, PIAs are needed). That you can't use GDPR to e.g. delete random company data just because you are somehow associated to it is only logical, but I would not really count that as "GDPR not applying in full". That was understandably never the intent of the law, and it is detailed enough to avoid silly scenarios.