GDPR has been in force since 2018, but in most companies and institutions, it looks the same as on day one: somewhere there are some “policies”, someone once did a “document-based” implementation, and personal data… well, lives its own life.
The longer I work with organisations, the more I see that GDPR is not a legal problem. GDPR is an organisational and technical problem.
This means that knowing the regulations alone does nothing – you need to know how to organise data, processes, people, and systems to avoid risks.
Below, you’ll find a practical guide that shows where companies most often make mistakes and what true GDPR compliance means in 2025.
1. GDPR Is Not Documents. GDPR Is Processes and Accountability
The most common pattern:
- a company orders a “GDPR implementation”,
- receives a binder + PDF,
- shelves it,
- no one knows what’s in it,
- no one applies it.
Then an incident happens: a former employee takes data, a laptop is stolen, or someone sends an email to 150 people in CC instead of BCC.
And that’s when real GDPR begins:
can we prove we knew what we were doing?
GDPR is a system:
- what we collect,
- why,
- on what basis,
- who has access,
- when we delete,
- how we secure,
- how we respond to incidents,
- how we collaborate with suppliers.
It’s not a one-time project – it’s a cycle where we are accountable for data from start to finish.
2. “We Have GDPR” ≠ “We Are GDPR-Compliant”
Having a security policy doesn’t mean the company follows it.
Regulators and auditors look at reality, not what’s in the binder.
Most common sins:
- policy says encrypt – no one encrypts,
- policy says retention – no one deletes data,
- policy says backups – backups don’t work or no one tests recovery,
- there’s an access list – but departed employees’ accounts still active,
- documentation describes “incident response procedure” – no one knows it.
True compliance starts when:
- policies match reality (not the other way around),
- processes are realistic, short, simple,
- they can be implemented without an MBA and a law PhD.
3. Personal Data Is Everywhere – Even Where No One Sees It
Examples from real companies:
- “/backup_old/” folder from 8 years ago with full ID scans,
- “Copy (3)” Excel with customer data on accountant’s personal laptop,
- Google Sheets shared with a former employee,
- USB with customer database in a drawer,
- Server logs with emails, IPs, and identifiers,
- Camera recordings kept for years “just in case”,
- Invoices with customer data in passwordless Dropbox.
GDPR doesn’t say: “have documents”.
GDPR says: have control over all data – identify, classify, protect, delete.
4. Suppliers and Processors – The Weakest Link
Most companies check suppliers for price, quality, delivery – but forget GDPR.
Reality:
- SaaS without DPA (Data Processing Agreement),
- Cloud without encryption or access controls,
- External IT with full admin rights, no logs,
- Marketing agencies with customer data, no audits.
GDPR requires:
- DPA for every processor,
- risk assessment,
- audit rights,
- data location control,
- incident reporting clauses.
One weak supplier = your GDPR violation.
5. Incidents and Breaches – Not “If”, But “When”
Most companies have an “incident procedure” – but it’s never tested.
Common mistakes:
- no incident registry,
- no escalation process,
- no DPO (Data Protection Officer) or equivalent,
- breaches reported too late (or not at all),
- no root-cause analysis.
GDPR Art. 33-34: report high-risk breaches within 72 hours.
But real value: use incidents to improve – analyse, fix, train.
6. GDPR = Risk Management + Cybersecurity
Few say it out loud:
GDPR is nothing but risk management + cybersecurity.
Art. 32 GDPR:
- encryption,
- pseudonymisation,
- confidentiality,
- integrity,
- system resilience,
- security testing,
- data recovery post-incident.
Sounds like ISO 27001? NIST? CMMC Level 1/2?
Because it is exactly that.
The problem arises when:
- documents done by lawyers,
- tech by IT,
- no bridge between them.
GDPR works only when:
- law,
- procedures,
- infrastructure,
- cyber,
- backups,
- suppliers,
- users
form a coherent system.
7. The Key Question: Can the Company Show Evidence?
GDPR in 2025 is about evidencing – proving that procedures work.
Not:
- “we have it written”,
- “it should work”,
- “IT said it’s OK”.
But:
- logs,
- registries,
- procedures,
- screenshots,
- training confirmations,
- backup tests,
- incident logs,
- supplier verification proofs.
Documents are 20%. Evidence is 80%.
8. GDPR in SMEs – What You Really Need
Contrary to appearances, most companies don’t need a 300-page implementation.
What they really need:
- short, realistic policies,
- processes everyone understands,
- encryption, backups, and segmentation,
- simple risk assessment,
- supplier review,
- practical monitoring,
- someone who actually oversees it.
In practice, companies need an external data security operator who handles everything holistically: from procedures to firewalls and backups.
9. GDPR Doesn’t Have to Be Hard, But It Must Be Consistent
Implementations fail when:
- documents are from outer space,
- policies and infrastructure say different things,
- no accountable person,
- suppliers operate unchecked,
- no incident response,
- no risk monitoring.
It works when:
- someone views data as a technical-legal process,
- cyber, law, OT/IT, procedures, and people collaborate,
- there’s simplicity, technology, and accountability.
10. The Future of GDPR Is Automation and Cybersecurity
The world is moving towards:
- automatic retention,
- automatic incident detection,
- automatic access policies,
- automatic reports,
- automatic backup tests.
GDPR is becoming less paper-based and more cyber-centric.
Companies stuck with documents and “nice binders” will fall behind.
Those shifting GDPR to:
- processes,
- systems,
- logs,
- evidence
will be secure regardless of regulatory changes.
Summary
GDPR is not black magic, but it requires:
- technical knowledge,
- process design skills,
- risk understanding,
- incident experience,
- IT/OT practice,
- work with documents and evidence.
It’s a blend of cybersecurity, digital forensics, and risk management.
Companies that want peace of mind seek someone who can bridge these worlds –
not just write documents.
Get in Touch
Secure your company.
I help with selection, implementation, and auditing of effective protection solutions.
Email: biuro@wichran.pl
Phone: +48 515 601 621
Author: Piotr Wichrań – Court-appointed IT forensic expert, IT/OT cybersecurity specialist, licensed private investigator
@Informatyka.Sledcza