My firm had a GDPR expert come in for an education conference. They were not messing around when they wrote that law. It is SERIOUS stuff, with SERIOUS penalties, and from what I learned, it is SERIOUSLY easy to violate. If you have a company that falls under the jurisdiction of the GDPR, you better have your ducks in a row, or have a huge insurance policy. The fines can be game-over for certain smaller companies.