The authors of the European Union’s General Data Protection Regulation (GDPR) left a lot to be interpreted by the courts. After 21 months we have seen initial complaints and fines against the big companies like Facebook and Google as expected. However, there are several smaller profile cases that have already been decided that provide insight into how GDPR will be applied, and perhaps just as importantly how smaller organizations are just as likely to be caught as the ones with deep pocket