GDPR, five months on: what the first controls taught us
Five months into the GDPR era, the predicted wave of headline fines has not arrived, and some organizations have quietly concluded that the regulation's teeth were exaggerated. The early supervisory activity tells a different and more useful story, for anyone reading it closely.
The first controls, in France, Germany, and elsewhere, follow a pattern. The authorities are not hunting for villains; they are asking companies to demonstrate ordinary claims. You say data is deleted after two years: show the mechanism. You say only these processors receive personal data: show the flows. You say consent governs this processing: show where it is checked.
The question behind every question
Each of these requests reduces to the same capability: can you draw your data flows, from live systems rather than from the documentation written in May? Most organizations spent their GDPR programs on the paperwork, records of processing, privacy notices, DPO appointments, and assumed the systems matched. The first controls are revealing how often they do not: the analytics script nobody declared, the export a team set up in 2016, the backup that retains what the policy says is erased.
The registry of processing activities was the homework. The data flows are the exam.
Why the paperwork was the easy part
It is worth understanding why so many well-resourced organizations find themselves exposed on exactly this point. The paperwork was tractable: it could be produced by a project team, on a schedule, and signed off. Drawing the actual data flows is a different kind of task, because it depends not on what the organization decided its data flows should be, but on what its systems are really doing, accumulated over years of individual engineering decisions that no policy document ever captured.
This is the gap the early controls are probing, and it is a gap of knowledge, not of intention. A company can be entirely sincere in its privacy notice and still be unable to prove it, because the person who wrote the notice and the systems that move the data have never been reconciled. The regulators have, sensibly, gone straight to the place where sincerity and reality diverge: not the promise, but the evidence that the promise is kept.
Where to invest next
For integration teams, the implication is concrete: the paths personal data takes between systems, internal and external, need to be visible, governed, and recorded as a property of the infrastructure. When flows pass through governed APIs, the question "who received this person's data, and when?" has an answer measured in minutes. That is also, not coincidentally, most of what is needed to honor access and erasure requests without heroics.
The fines will come eventually; enforcement always ramps. The organizations that will meet them calmly are spending this quiet period making their systems match their paperwork.