Am in EU, am involved in some compliance stuff and have talked to plenty others at other companies, and it really does seem to be a nothing-to-see-here for all companies except the sleezy ones.

The only person who’s opinion you should worry about is your internal legal counsel’s. The nerds who try to carry on like this is a technical problem with a technical solution are so far off. It’s about beig able to argue and justify your interpretation - not how much you have gold plated your tech stack

All law has room for interpretation, that's what the courts are for.

There are no targets for bureaucrats.

What targets? Where have you heard something about targets?

I think the biggest complaint I've heard so far is that there is too much room for interepration at the moment, we currently lack any case law.

And if you are a small/medium business, don't comply and somehow are reported, you will receive an email from the regalutory instance of the country the person who reported you come from. They will tell you what is wrong and point you to some articles who can give you advices on how to comply. If you have difficulty to do so, you can contact them and ask specific advices, they will respond (probably a bit late) and as long as you comply with the RGPD within a month after that, you're good.

Audit can take some time and have a real impact on your business though, so i'm not saying everything is perfect. But to me, audit is the only thing you have to be really afraid of, not fines.

It's especially hard for a small sized business where all your clients are either departments of the government or leasing companies.

Yes, and it is not that hard a read. The only problems people seem to be having are in trying to finesse the rules to avoid looking after data with due diligence. If you really want to look after data, then you just need to do that, and you will be compliant.

There is TLDR version, it is called the checklist. Here is one:

https://ico.org.uk/for-organisations/resources-and-support/d...

It captures the compliance with a checklist which is shorter than the original 88 page law.