[allenjhyang]

From my experience helping my company with GDPR, IMO it's true that the principles of GDPR are straightforward. But there can be a fair amount of ambiguity in how certain parts are interpreted, so in practice if you're taking it seriously (which every company should), you'll want to loop in your lawyers. Then there are more and more conversations to make sure everybody understands what the company is doing and what their stance is on GDPR.

Sadly, GDPR is not a black-and-white (pun intended with the chess project) checklist with black-and-white checklist items.