[ust]

Yeah, I agree with everything you said.

It would be interesting to know whether the big companies have addressed (at least partially) their GDPR compliance. Maybe they do just "play Russian roulette" like you said, and hope for the best.. Of course, implementation guidelines are not yet fully defined (like WP29 opinions, some of them will change, even then, those opinions are not legally binding).

[jacquesm]

From what I've seen it strongly depends on the vertical but there are outliers both ways. With medical and fintech (banks, IPSPs, insurance) you can expect they are on average doing ok though there are some bad counterexamples. E-commerce is only just now starting to wake up and everybody else is going to be playing catch-up for the next couple of years.

Note that my sample is relatively small and mostly western European countries (nl, be, de, uk).