GDPR in practice: the 10 mistakes CDOs make most often

British Airways was fined £20 million by the UK ICO in October 2020 for a data breach affecting more than 400,000 customers. Amazon was fined €746 million by Luxembourg's data protection authority in 2021 for GDPR violations in how it processes personal data for advertising.

These aren't edge cases. They're the new normal. And in both cases, the data protection failures were preventable.

The 10 GDPRGDPREU regulation governing how organizations collect, store and use personal data, with fines tied to global revenue for breaches.View full definition → mistakes CDOs make most often

1. Treating consent as the default lawful basis for everything

GDPR defines six lawful bases for processing personal data. Consent is one of them, but it's often the wrong one. Consent requires a specific, freely given, unambiguous opt-in that can be withdrawn at any time. If a customer withdraws consent, you must stop processing and, in most cases, delete their data. For most commercial data processing, legitimate interests or contractual necessity is a more appropriate basis. CDOs who default to consent for everything create both compliance complexity and operational fragility.

1. Not maintaining a Record of Processing Activities (ROPA)

GDPR Article 30 requires organizations to maintain a register of all data processing activities. Most organizations have one, but it's incomplete, outdated, or maintained by a junior compliance officer who doesn't have visibility into all processing. The ROPA should be a living document, updated every time a new system processes personal data. The CDO should own it.

1. Confusing anonymization with pseudonymization

Anonymized data is outside GDPR's scope. Pseudonymized data (data where the direct identifier has been replaced with a code but re-identification is theoretically possible) is still personal data under GDPR. Many organizations claim to have "anonymized" data that is actually pseudonymized, creating a significant regulatory risk when they share that data with third parties.

1. Missing the 72-hour breach notification window

When a personal data breach occurs, GDPR requires notification to the supervisory authority within 72 hours of becoming aware of it. Most organizations don't have a process that makes this possible. The CDO needs to ensure a breach response process exists before a breach happens.

1. Ignoring data subject rights operationalization

GDPR grants individuals a set of rights: access, rectification, erasure, restriction of processing, data portability, objection, and rights related to automated individual decision-making including profiling. (There is also the right to be informed, and the right to withdraw consent where consent is the basis.) Organizations must respond without undue delay and within one month. Most organizations have a process for handling these requests, but it's manual, slow, and doesn't scale. A data subject access request (DSAR) involving multiple systems can take days of manual work per request. At 1,000 DSARs per month, this becomes a significant operational burden that technology must solve.

1. Underestimating data transfers outside the EU

If you use a US-based cloud provider (AWS, Azure, Google Cloud), you are technically transferring personal data outside the EU. Post-Schrems II, this requires a valid transfer mechanism: Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or reliance on the EU-US Data Privacy Framework. Many organizations haven't completed this analysis for all their processors.

1. Not appointing a Data Protection Officer when required

A DPO is mandatory for public authorities, organizations that conduct large-scale systematic monitoring, and organizations that process special category data at scale. Many organizations in these categories don't have one, or have a DPO who lacks independence (the DPO cannot be given instructions about how to perform their tasks).

1. Inadequate vendor management

Every third party that processes personal data on your behalf is a data processor. You need a Data Processing Agreement (DPA) with each one. Most organizations have DPAs for their major vendors but miss dozens of smaller tools: analytics platforms, marketing tools, recruitment software, all processing personal data without a compliant DPA.

1. Privacy by design treated as an afterthought

GDPR requires privacy by design and by default. In practice, this means data protection impact assessments (DPIAs) must be conducted before new systems or processes are built, not after. Most organizations conduct DPIAs reactively, when a regulator asks, not before building.

1. Ignoring special category data

Special category data (health, biometric, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, and more) requires explicit consent or a specific exemption. Criminal offence data has its own separate regime under Article 10. Organizations frequently process special category data without realizing it: a wellness app processing health data, an HR system processing disability information, an AI model trained on data that reveals religious affiliation.

The fine as a business case

Use GDPR fines as a business case for investment in privacy infrastructure. The Amazon fine (€746M) was approximately 0.1% of annual revenue, but the reputational damage and ongoing compliance costs were far higher. A €200K investment in privacy management technology, proper DPA management, and staff training is an easy ROI to calculate against that risk.

Key Takeaways

• Consent is one of six lawful bases, and usually not the right one. Default to legitimate interests or contractual necessity for commercial processing.
• Keep the ROPA current and owned by the CDO, not buried with a junior compliance officer.
• Pseudonymized data is still personal data. Only truly anonymized data falls outside GDPR.
• Build the breach response process before a breach: the clock runs for 72 hours from awareness.
• Data subject requests must be answered within one month. Manual handling does not scale past a few hundred a month.
• Check transfer mechanisms for every US processor, not just the big three cloud providers.
• A missing DPA with a small analytics or recruitment tool is as much a violation as one with a major vendor.