And what exactly is making it complicated? I've also helped a bunch of organization become compliant, some were easier than others. The ones that were harder w

And what exactly is making it complicated? I've also helped a bunch of organization become compliant, some were easier than others. The ones that were harder were the ones that generally didn't have good processes with data in the first place, where everything was scattered all over the place and everyone had access to everything. It makes sense to me that it's harder to be compliant if you were borderline malicious with how you treated personal data before GDPR.